CVE-2016-5385

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-5385
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.1 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1609.html Broken Link Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1610.html Broken Link Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1611.html Broken Link Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1612.html Broken Link Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1613.html Broken Link Third Party Advisory
http://www.debian.org/security/2016/dsa-3631 Third Party Advisory
http://www.kb.cert.org/vuls/id/797896 Third Party Advisory US Government Resource
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory
http://www.securityfocus.com/bid/91821 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1036335 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1353794 Issue Tracking Third Party Advisory VDB Entry
https://github.com/guzzle/guzzle/releases/tag/6.2.1 Release Notes Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05333297 Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 Third Party Advisory
https://httpoxy.org/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/
https://security.gentoo.org/glsa/201611-22 Third Party Advisory
https://www.drupal.org/SA-CORE-2016-003 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:hp:storeever_msl6480_tape_library_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:storeever_msl6480_tape_library:-:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 8 (hide)

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

Configuration 9 (hide)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
History

12 Feb 2023, 23:23

Type Values Removed Values Added
Summary It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-5385', 'name': 'https://access.redhat.com/security/cve/CVE-2016-5385', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1609', 'name': 'https://access.redhat.com/errata/RHSA-2016:1609', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1610', 'name': 'https://access.redhat.com/errata/RHSA-2016:1610', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1612', 'name': 'https://access.redhat.com/errata/RHSA-2016:1612', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1611', 'name': 'https://access.redhat.com/errata/RHSA-2016:1611', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1613', 'name': 'https://access.redhat.com/errata/RHSA-2016:1613', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:17

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/', 'name': 'FEDORA-2016-8eb11666aa', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/', 'name': 'FEDORA-2016-9c8cf5912c', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/', 'name': 'FEDORA-2016-4e7db3d437', 'tags': ['Third Party Advisory'], 'refsource': 'FEDORA'}
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-5385 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1609 -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/ -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1611 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1610 -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/ -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1612 -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/ -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1613 -
Summary PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request.

29 Aug 2022, 20:10

Type Values Removed Values Added
CWE CWE-284 CWE-601

29 Sep 2021, 16:17

Type Values Removed Values Added
CPE cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* cpe:2.3:a:oracle:communications_user_data_repository:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_user_data_repository:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.2:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1611.html - Third Party Advisory (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1611.html - Broken Link, Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1610.html - Third Party Advisory (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1610.html - Broken Link, Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1613.html - Third Party Advisory (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1613.html - Broken Link, Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1609.html - Third Party Advisory (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1609.html - Broken Link, Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1612.html - Third Party Advisory (REDHAT) http://rhn.redhat.com/errata/RHSA-2016-1612.html - Broken Link, Third Party Advisory
References (CONFIRM) https://github.com/guzzle/guzzle/releases/tag/6.2.1 - Third Party Advisory (CONFIRM) https://github.com/guzzle/guzzle/releases/tag/6.2.1 - Release Notes, Third Party Advisory
Information

Published : 2016-07-19 02:00

Updated : 2023-12-10 11:46

NVD link : CVE-2016-5385

Mitre link : CVE-2016-5385

CVE.ORG link : CVE-2016-5385

JSON object : View

Products Affected

hp

  • system_management_homepage
  • storeever_msl6480_tape_library
  • storeever_msl6480_tape_library_firmware

php

  • php

redhat

  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_workstation

drupal

  • drupal

opensuse

  • leap

debian

  • debian_linux

oracle

  • communications_user_data_repository
  • enterprise_manager_ops_center
  • linux

fedoraproject

  • fedora
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')