PHP up to and including 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote malicious users to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
oracle enterprise manager ops center 12.2.2 |
||
oracle enterprise manager ops center 12.3.2 |
||
oracle communications user data repository 10.0.1 |
||
oracle linux 6 |
||
oracle linux 7 |
||
oracle communications user data repository 12.0.0 |
||
oracle communications user data repository 10.0.0 |
||
fedoraproject fedora 24 |
||
fedoraproject fedora 23 |
||
hp storeever_msl6480_tape_library_firmware |
||
hp system management homepage |
||
php php |
||
redhat enterprise linux desktop 6.0 |
||
redhat enterprise linux server 6.0 |
||
redhat enterprise linux workstation 6.0 |
||
debian debian linux 8.0 |
||
opensuse leap 42.1 |
||
drupal drupal |
So you know it's really scary
A dangerous easy-to-exploit vulnerability discovered 15 years ago has reared its head again, leaving server-side website software potentially open to hijackers. The Apache Software Foundation, Red Hat, Ngnix and others have rushed to warn programmers of the so-called httpoxy flaw, specifically: CVE-2016-5385 in PHP; CVE-2016-5386 in Go; CVE-2016-5387 in Apache HTTP server; CVE-2016-5388 in Apache TomCat; CVE-2016-1000109 in PHP-engine HHVM; and CVE-2016-1000110 in Python. This security hole, pre...
Vulmon