CVE-2016-5385

MEDIUM

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

References

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

http://rhn.redhat.com/errata/RHSA-2016-1609.html

http://rhn.redhat.com/errata/RHSA-2016-1610.html

http://rhn.redhat.com/errata/RHSA-2016-1611.html

http://rhn.redhat.com/errata/RHSA-2016-1612.html

http://rhn.redhat.com/errata/RHSA-2016-1613.html

http://www.debian.org/security/2016/dsa-3631

http://www.kb.cert.org/vuls/id/797896

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

http://www.securityfocus.com/bid/91821

http://www.securitytracker.com/id/1036335

https://bugzilla.redhat.com/show_bug.cgi?id=1353794

https://github.com/guzzle/guzzle/releases/tag/6.2.1

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://httpoxy.org/

https://lists.fedoraproject.org/archives/list/[email protected]/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/

https://lists.fedoraproject.org/archives/list/[email protected]/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/

https://lists.fedoraproject.org/archives/list/[email protected]/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/

https://security.gentoo.org/glsa/201611-22

https://www.drupal.org/SA-CORE-2016-003

Details

Source: MITRE

Published: 2016-07-19

Updated: 2019-12-27

Type: CWE-284

Risk Information

CVSS v2.0

Base Score: 5.1

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 4.9

Severity: MEDIUM

CVSS v3.0

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.2

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

Configuration 3

AND

OR

cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*

OR

cpe:2.3:h:hp:storeever_msl6480_tape_library:-:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* versions up to 7.5.5.0 (inclusive)

Configuration 5

OR

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 7.0.8 (inclusive)

Configuration 6

OR

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Tenable Plugins

View all (34 total)

IDNameProductFamilySeverity
98855PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)Web Application ScanningComponent Vulnerability
high
98814PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)Web Application ScanningComponent Vulnerability
high
119987SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2941-1) (httpoxy)NessusSuSE Local Security Checks
high
101837Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)NessusMisc.
high
96010Debian DLA-749-1 : php5 security update (httpoxy)NessusDebian Local Security Checks
high
95746openSUSE Security Update : php7 (openSUSE-2016-1440) (httpoxy)NessusSuSE Local Security Checks
high
95421GLSA-201611-22 : PHP: Multiple vulnerabilities (httpoxy)NessusGentoo Local Security Checks
high
94654HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)NessusWeb Servers
high
92997Scientific Linux Security Update : php on SL7.x x86_64 (20160811) (httpoxy)NessusScientific Linux Local Security Checks
medium
92965Scientific Linux Security Update : php on SL6.x i386/x86_64 (20160811) (httpoxy)NessusScientific Linux Local Security Checks
medium
92952CentOS 7 : php (CESA-2016:1613) (httpoxy)NessusCentOS Local Security Checks
medium
92941RHEL 7 : php (RHSA-2016:1613) (httpoxy)NessusRed Hat Local Security Checks
medium
92940RHEL 6 : php (RHSA-2016:1609) (httpoxy)NessusRed Hat Local Security Checks
medium
92937Oracle Linux 7 : php (ELSA-2016-1613) (httpoxy)NessusOracle Linux Local Security Checks
medium
92936Oracle Linux 6 : php (ELSA-2016-1609) (httpoxy)NessusOracle Linux Local Security Checks
medium
92872CentOS 6 : php (CESA-2016:1609) (httpoxy)NessusCentOS Local Security Checks
medium
9460PHP 5.5.x < 5.5.38 / 5.6.x < 5.6.24 / 7.0.x < 7.0.9 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
92714openSUSE Security Update : php5 (openSUSE-2016-921) (httpoxy)NessusSuSE Local Security Checks
high
92699Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : php5, php7.0 vulnerabilities (USN-3045-1) (httpoxy)NessusUbuntu Local Security Checks
high
92663Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)NessusAmazon Linux Local Security Checks
high
92650Fedora 23 : php (2016-cd2bd0800f) (httpoxy)NessusFedora Local Security Checks
medium
92648Fedora 24 : php (2016-8eb11666aa) (httpoxy)NessusFedora Local Security Checks
medium
92621Fedora 23 : php-guzzlehttp-guzzle (2016-e2c8f5f95a) (httpoxy)NessusFedora Local Security Checks
medium
92619Fedora 24 : php-guzzlehttp-guzzle (2016-aef8a45afe) (httpoxy)NessusFedora Local Security Checks
medium
92618Fedora 23 : php-guzzlehttp-guzzle6 (2016-9c8cf5912c) (httpoxy)NessusFedora Local Security Checks
medium
92616Fedora 24 : php-guzzlehttp-guzzle6 (2016-4e7db3d437) (httpoxy)NessusFedora Local Security Checks
medium
92574FreeBSD : php -- multiple vulnerabilities (b6402385-533b-11e6-a7bd-14dae9d210b8) (httpoxy)NessusFreeBSD Local Security Checks
high
92573Debian DSA-3631-1 : php5 - security update (httpoxy)NessusDebian Local Security Checks
high
92556PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
high
92555PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
high
92554PHP 5.5.x < 5.5.38 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
high
92539HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)NessusWeb Servers
medium
92499Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2016-203-02) (httpoxy)NessusSlackware Local Security Checks
medium
92495Drupal 8.x < 8.1.7 PHP HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)NessusCGI abuses
medium