NVD

Id
20655  
Name
CVE-2016-5385  
Description
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application"s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv("HTTP_PROXY") call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-07-18  
Modified Date
2016-11-28  
Seq
2016-5385  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
113037 20655 CVE-2016-5385 openSUSE-SU-2016:1922  View
113038 20655 CVE-2016-5385 RHSA-2016:1609  View
113039 20655 CVE-2016-5385 RHSA-2016:1610  View
113040 20655 CVE-2016-5385 RHSA-2016:1611  View
113041 20655 CVE-2016-5385 RHSA-2016:1612  View
113042 20655 CVE-2016-5385 RHSA-2016:1613  View
113043 20655 CVE-2016-5385 VU#797896  View
113044 20655 CVE-2016-5385 http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html  View
113045 20655 CVE-2016-5385 91821  View
113046 20655 CVE-2016-5385 https://bugzilla.redhat.com/show_bug.cgi?id=1353794  View
113047 20655 CVE-2016-5385 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149  View
113048 20655 CVE-2016-5385 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297  View
113049 20655 CVE-2016-5385 https://httpoxy.org/  View
113050 20655 CVE-2016-5385 FEDORA-2016-8eb11666aa  View
113051 20655 CVE-2016-5385 FEDORA-2016-9c8cf5912c  View
113052 20655 CVE-2016-5385 FEDORA-2016-4e7db3d437  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3027 JVNDB-2016-003800 PHP における任意のプロキシサーバにアプリケーションのアウトバウンド HTTP トラフィックをリダイレクトされる脆弱性 PHP は、RFC 3875 セクション 4.1.18 の名前空間のコンフリクト対処を試みず、その結果、 HTTP_PROXY 環境変数の信頼できないクライアントデータの存在からアプリケーションを保護しないため、任意のプロキシサーバにアプリケーションのアウトバウンド HTTP トラフィックをリダイレクトされる脆弱性が存在します。 CVE-2016-5385 91891 CVE-2016-5385 20655 5.1 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003800.html 2016-07-18 2016-12-27 View