CVE-2016-5385

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1353794

http://www.kb.cert.org/vuls/id/797896

https://httpoxy.org/

https://lists.fedoraproject.org/archives/list/[email protected]/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/

https://lists.fedoraproject.org/archives/list/[email protected]/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/

https://lists.fedoraproject.org/archives/list/[email protected]/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297

http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

http://www.securityfocus.com/bid/91821

http://rhn.redhat.com/errata/RHSA-2016-1611.html

http://rhn.redhat.com/errata/RHSA-2016-1612.html

http://rhn.redhat.com/errata/RHSA-2016-1613.html

http://rhn.redhat.com/errata/RHSA-2016-1610.html

http://rhn.redhat.com/errata/RHSA-2016-1609.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722

https://www.drupal.org/SA-CORE-2016-003

https://github.com/guzzle/guzzle/releases/tag/6.2.1

https://security.gentoo.org/glsa/201611-22

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us

http://www.securitytracker.com/id/1036335

http://www.debian.org/security/2016/dsa-3631

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Details

Source: MITRE

Published: 2016-07-19

Updated: 2021-09-29

Type: CWE-284

Risk Information

CVSS v2

Base Score: 5.1

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 4.9

Severity: MEDIUM

CVSS v3

Base Score: 8.1

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.2

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*

cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

Configuration 3

AND

OR

cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*

OR

cpe:2.3:h:hp:storeever_msl6480_tape_library:-:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:* versions up to 7.5.5.0 (inclusive)

Configuration 5

OR

cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 7.0.8 (inclusive)

Configuration 6

OR

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 7

OR

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 8

OR

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

Configuration 9

OR

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Tenable Plugins

View all (34 total)

IDNameProductFamilySeverity
98855PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)Web Application ScanningComponent Vulnerability
critical
98814PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)Web Application ScanningComponent Vulnerability
critical
119987SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2941-1) (httpoxy)NessusSuSE Local Security Checks
critical
101837Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)NessusMisc.
critical
96010Debian DLA-749-1 : php5 security update (httpoxy)NessusDebian Local Security Checks
critical
95746openSUSE Security Update : php7 (openSUSE-2016-1440) (httpoxy)NessusSuSE Local Security Checks
critical
95421GLSA-201611-22 : PHP: Multiple vulnerabilities (httpoxy)NessusGentoo Local Security Checks
critical
94654HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)NessusWeb Servers
high
92997Scientific Linux Security Update : php on SL7.x x86_64 (20160811) (httpoxy)NessusScientific Linux Local Security Checks
high
92965Scientific Linux Security Update : php on SL6.x i386/x86_64 (20160811) (httpoxy)NessusScientific Linux Local Security Checks
high
92952CentOS 7 : php (CESA-2016:1613) (httpoxy)NessusCentOS Local Security Checks
high
92941RHEL 7 : php (RHSA-2016:1613) (httpoxy)NessusRed Hat Local Security Checks
high
92940RHEL 6 : php (RHSA-2016:1609) (httpoxy)NessusRed Hat Local Security Checks
high
92937Oracle Linux 7 : php (ELSA-2016-1613) (httpoxy)NessusOracle Linux Local Security Checks
high
92936Oracle Linux 6 : php (ELSA-2016-1609) (httpoxy)NessusOracle Linux Local Security Checks
high
92872CentOS 6 : php (CESA-2016:1609) (httpoxy)NessusCentOS Local Security Checks
high
9460PHP 5.5.x < 5.5.38 / 5.6.x < 5.6.24 / 7.0.x < 7.0.9 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
92714openSUSE Security Update : php5 (openSUSE-2016-921) (httpoxy)NessusSuSE Local Security Checks
critical
92699Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : php5, php7.0 vulnerabilities (USN-3045-1) (httpoxy)NessusUbuntu Local Security Checks
critical
92663Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)NessusAmazon Linux Local Security Checks
critical
92650Fedora 23 : php (2016-cd2bd0800f) (httpoxy)NessusFedora Local Security Checks
high
92648Fedora 24 : php (2016-8eb11666aa) (httpoxy)NessusFedora Local Security Checks
high
92621Fedora 23 : php-guzzlehttp-guzzle (2016-e2c8f5f95a) (httpoxy)NessusFedora Local Security Checks
high
92619Fedora 24 : php-guzzlehttp-guzzle (2016-aef8a45afe) (httpoxy)NessusFedora Local Security Checks
high
92618Fedora 23 : php-guzzlehttp-guzzle6 (2016-9c8cf5912c) (httpoxy)NessusFedora Local Security Checks
high
92616Fedora 24 : php-guzzlehttp-guzzle6 (2016-4e7db3d437) (httpoxy)NessusFedora Local Security Checks
high
92574FreeBSD : php -- multiple vulnerabilities (b6402385-533b-11e6-a7bd-14dae9d210b8) (httpoxy)NessusFreeBSD Local Security Checks
critical
92573Debian DSA-3631-1 : php5 - security update (httpoxy)NessusDebian Local Security Checks
critical
92556PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
critical
92555PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
critical
92554PHP 5.5.x < 5.5.38 Multiple Vulnerabilities (httpoxy)NessusCGI abuses
critical
92539HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)NessusWeb Servers
high
92499Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2016-203-02) (httpoxy)NessusSlackware Local Security Checks
high
92495Drupal 8.x < 8.1.7 PHP HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)NessusCGI abuses
high