CVE-2016-5388: High severity redhat Enterprise Linux Desktop vulnerability
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Other sources
Dominic Scheirlinck of VendHQ reports:
Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTPPROXY” environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service.
The Tomcat server contains support for CGI. If passed a “Proxy” header in the request CGIServlet will automatically populate the HTTPPROXY environmental variable with whatever user supplied value is present.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5388?
CVE-2016-5388 has a medium severity rating as it allows for potential remote code execution due to improper handling of untrusted client data.
How do I fix CVE-2016-5388?
To fix CVE-2016-5388, upgrade to Apache Tomcat version 7.0.72, 8.5.5, or higher, or apply the respective patch provided by your software supplier.
What versions of Apache Tomcat are affected by CVE-2016-5388?
Apache Tomcat versions 7.0.0 to 7.0.70 and 8.0 to 8.5.4 are affected by CVE-2016-5388.
Can CVE-2016-5388 be exploited remotely?
Yes, CVE-2016-5388 can be exploited remotely if the CGI Servlet is enabled, allowing attackers to redirect applications.
Is CVE-2016-5388 related to client data security?
Yes, CVE-2016-5388 is related to client data security, specifically regarding the handling of untrusted data in the HTTP_PROXY environment variable.