CVE-2016-5385
At a glance
- Source
- NVD
- EPSS
- EPSS 50.43 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Weaknesses (CWE)
- CWE-601 — URL Redirection to Untrusted Site
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297
- http://www.kb.cert.org/vuls/id/797896
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://security.gentoo.org/glsa/201611-22
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html
- https://www.drupal.org/SA-CORE-2016-003
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://rhn.redhat.com/errata/RHSA-2016-1613.html
- http://rhn.redhat.com/errata/RHSA-2016-1611.html
- http://rhn.redhat.com/errata/RHSA-2016-1610.html
- http://www.debian.org/security/2016/dsa-3631
- http://www.securityfocus.com/bid/91821
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/
- http://rhn.redhat.com/errata/RHSA-2016-1609.html
- http://www.securitytracker.com/id/1036335
- https://httpoxy.org/
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://rhn.redhat.com/errata/RHSA-2016-1612.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1353794
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/
- https://github.com/guzzle/guzzle/releases/tag/6.2.1
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-m6ch-gg5f-wxx3 — HTTP Proxy header vulnerability
European references
- ENISA EUVD · EUVD-2016-6335
- GCVE · GCVE-0-2016-5385
CERT-FR advisories
- CERTFR-2016-AVI-240 — Vulnérabilité dans Drupal · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*≤ 5.09cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*≤ 7.5.5.0cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 5.5.0 < 5.5.38cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 5.6.0 < 5.6.24cpe:2.3:a:php:php:*:*:*:*:*:*:*:*≥ 7.0.0 ≤ 7.0.8cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.1.7
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |