Ask the Community
Groups
CVE-2016-5387: Apache HTTPD: Proxy header sets environment - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2016-5387</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p>It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.<br><br>Unitrends risk assessment: High<br> </p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p>For CentOS6, resolved in <u>httpd-2.2.15-54.el6</u> included in the latest security update<br>For CentOS5, resolved in httpd-2.2.3-92.el5_11, not included. Migrate to CentOS6.<br><br> </p> <h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fcve%2Fcve-2016-5387%250D%250Ahttps%3A%2F%2Frhn.redhat.com%2Ferrata%2FRHSA-2016-1421.html%250D%250Ahttps%3A%2F%2Fweb.nvd.nist.gov%2Fview%2Fvuln%2Fdetail%3FvulnId%3DCVE-2016-5387">https://access.redhat.com/security/cve/cve-2016-5387 https://rhn.redhat.com/errata/RHSA-2016-1421.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5387</a></li></ul><h3 data-id="notes"><strong>NOTES</strong></h3> <p><br> </p> </article> </main>