Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 10 min 164 bronnen 65 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2016-5385

HIGH · 8.1 CVSS Gepubliceerd: CWE-601

Beschrijving NL

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configurati on of PHP, aka an "httpoxy" issue.

Origineel (Engels) tonen

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

Vendors

Oracle Fedoraproject Hp Php Redhat Debian Opensuse Drupal

Affected products

Communications User Data Repository Enterprise Manager Ops Center Linux Fedora Storeever Msl6480 Tape Library Firmware Storeever Msl6480 Tape Library System Management Homepage Php Enterprise Linux Desktop Enterprise Linux Server Enterprise Linux Workstation Debian Linux Leap Drupal

References