CVE-2016-5386
First published: Fri Jul 08 2016(Updated: )
Dominic Scheirlinck of VendHQ reports: Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTP_PROXY” environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service. The Go programming language can automatically populate the HTTP_PROXY environmental variable with a user supplied "Proxy" header.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject Fedora | =23 | |
| Fedoraproject Fedora | =24 | |
| Oracle Linux | =7 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Server Aus | =7.2 | |
| Redhat Enterprise Linux Server Eus | =7.2 | |
| Golang Go | >=1.0<1.6.3 | |
| Golang Go | =1.7-rc1 | |
| redhat/Go | <1.6.3 | 1.6.3 |
| redhat/Go | <1.7 | 1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2016-1538.html
- http://www.kb.cert.org/vuls/id/797896
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1353798
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- https://httpoxy.org/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1357601
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1357602
- https://groups.google.com/forum/#!topic/golang-announce/7jZDOQ8f8tM
- https://access.redhat.com/security/cve/CVE-2016-5386
- https://golang.org/cl/25010
- https://golang.org/issue/16405
- https://golang.org/issue/16354
- https://golang.org/dl
- https://rhn.redhat.com/errata/RHSA-2016-1538.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/remedy
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-5386
- agent/software-canonical-lookup
- agent/tags
- agent/event
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/23
- version/fedoraproject fedora/24
- vendor/oracle
- canonical/oracle linux
- version/oracle linux/7
- vendor/redhat
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.2
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.2
- vendor/golang
- canonical/golang go
- version/golang go/1.0
- version/golang go/1.7-rc1
- package-manager/redhat