CVE-2016-5387

Impact:
Important
Public Date:
2016-07-18
IAVA:
2016-B-0160, 2017-A-0010, 2017-A-0081
CWE:
CWE-20
Bugzilla:
1353755: CVE-2016-5387 Apache HTTPD: sets environmental variable based on user supplied Proxy request header
It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.

Find out more about CVE-2016-5387 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 5
Base Metrics AV:N/AC:L/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

CVSS v3 metrics

CVSS3 Base Score 5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality None
Integrity Impact Low
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Software Collections for Red Hat Enterprise Linux 7 (httpd24-httpd) RHSA-2016:1420 2016-07-18
Red Hat JBoss Web Server 3.0 for RHEL 7 RHSA-2016:1635 2016-08-18
Red Hat Enterprise Linux 6 (httpd) RHSA-2016:1421 2016-07-18
Red Hat JBoss Core Services 1 RHSA-2016:1625 2016-08-17
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server (httpd) RHSA-2016:1649 2016-08-22
Red Hat JBoss Web Server 2.1 RHSA-2016:1650 2016-08-22
Red Hat Software Collections for Red Hat Enterprise Linux 6 (httpd24-httpd) RHSA-2016:1420 2016-07-18
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server (httpd22) RHSA-2016:1648 2016-08-22
Red Hat JBoss Web Server 3.0 for RHEL 6 RHSA-2016:1636 2016-08-18
Red Hat JBoss Core Services on RHEL 7 Server (jbcs-httpd24-httpd) RHSA-2016:1851 2016-09-12
Red Hat JBoss Web Server 3.0 RHSA-2016:1624 2016-08-17
Red Hat JBoss Core Services on RHEL 6 Server (jbcs-httpd24-httpd) RHSA-2016:1851 2016-09-12
Red Hat Enterprise Linux 7 (httpd) RHSA-2016:1422 2016-07-18
Red Hat Enterprise Linux 5 (httpd) RHSA-2016:1421 2016-07-18

Affected Packages State

Platform Package State
Red Hat JBoss EWS 1 httpd Will not fix
Red Hat JBoss EAP 7 httpd22 Not affected
Red Hat JBoss EAP 6 httpd22 Affected

Acknowledgements

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

External References

Last Modified