CVE-2016-5387
High
Description
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Apache Http Server
PublishedJul 19, 2016
First seenJul 19, 2016
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2016:1420
- access.redhat.com/errata/RHSA-2016:1635
- access.redhat.com/errata/RHSA-2016:1851
- access.redhat.com/errata/RHSA-2016:1422
- access.redhat.com/errata/RHSA-2016:1421
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/
- security.gentoo.org/glsa/201701-36
- access.redhat.com/errata/RHSA-2016:1636
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.2.0 ≤ v ≤ 2.2.31, 2.4.1 ≤ v ≤ 2.4.23 | — |
| hp system_management_homepage | v ≤ 7.5.5.0 | — |
| oracle communications_user_data_repository | 10.0.0 ≤ v ≤ 12.4 | — |
| oracle enterprise_manager_ops_center | 12.2.2, 12.3.2 | — |
| oracle linux | 5, 6, 7 | — |
| oracle solaris | 11.3 | — |
| fedoraproject fedora | 23, 24 | — |
| redhat jboss_web_server | 2.1.0 | — |
| redhat jboss_enterprise_web_server | 2.0.0, 3.0.0 | — |
| redhat jboss_core_services | 1.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.2, 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.2, 7.3, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| debian debian_linux | 8.0 | — |
| canonical ubuntu_linux | 12.04, 14.04, 15.10, 16.04 | — |
| opensuse leap | 42.1 | — |
| opensuse opensuse | 13.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.