Details of VAR-201607-0657

ID

VAR-201607-0657

CVE

CVE-2016-5385

TITLE

CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables

Trust: 0.8

sources: CERT/CC: VU#797896

DESCRIPTION

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. Web servers running in a CGI or CGI-like context may assign client request Proxy header values to internal HTTP_PROXY environment variables. This vulnerability can be leveraged to conduct man-in-the-middle (MITM) attacks on internal subrequests or to direct the server to initiate connections to arbitrary hosts. This vulnerability "httpoxy" Is called a problem. PHP is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to perform unauthorized actions. This may lead to other attacks. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. There is a security vulnerability in PHP 7.0.8 and earlier versions, the vulnerability stems from the fact that the program does not resolve namespace conflicts in RFC 3875 mode. The program does not properly handle data from untrusted client applications in the HTTP_PROXY environment variable. A remote attacker uses the specially crafted Proxy header message in the HTTP request to exploit this vulnerability to implement a man-in-the-middle attack, directing the server to send a connection to any host. The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.24, which includes additional bug fixes. Please refer to the upstream changelog for more information: https://php.net/ChangeLog-5.php#5.6.24 For the stable distribution (jessie), these problems have been fixed in version 5.6.24+dfsg-0+deb8u1. For the unstable distribution (sid), these problems have been fixed in version 7.0.9-1 of the php7.0 source package. We recommend that you upgrade your php5 packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: php55-php security update Advisory ID: RHSA-2016:1611-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1611.html Issue date: 2016-08-11 CVE Names: CVE-2016-5385 ===================================================================== 1. Summary: An update for php55-php is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5385) Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: php55-php-5.5.21-5.el6.src.rpm x86_64: php55-php-5.5.21-5.el6.x86_64.rpm php55-php-bcmath-5.5.21-5.el6.x86_64.rpm php55-php-cli-5.5.21-5.el6.x86_64.rpm php55-php-common-5.5.21-5.el6.x86_64.rpm php55-php-dba-5.5.21-5.el6.x86_64.rpm php55-php-debuginfo-5.5.21-5.el6.x86_64.rpm php55-php-devel-5.5.21-5.el6.x86_64.rpm php55-php-enchant-5.5.21-5.el6.x86_64.rpm php55-php-fpm-5.5.21-5.el6.x86_64.rpm php55-php-gd-5.5.21-5.el6.x86_64.rpm php55-php-gmp-5.5.21-5.el6.x86_64.rpm php55-php-imap-5.5.21-5.el6.x86_64.rpm php55-php-intl-5.5.21-5.el6.x86_64.rpm php55-php-ldap-5.5.21-5.el6.x86_64.rpm php55-php-mbstring-5.5.21-5.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el6.x86_64.rpm php55-php-odbc-5.5.21-5.el6.x86_64.rpm php55-php-opcache-5.5.21-5.el6.x86_64.rpm php55-php-pdo-5.5.21-5.el6.x86_64.rpm php55-php-pgsql-5.5.21-5.el6.x86_64.rpm php55-php-process-5.5.21-5.el6.x86_64.rpm php55-php-pspell-5.5.21-5.el6.x86_64.rpm php55-php-recode-5.5.21-5.el6.x86_64.rpm php55-php-snmp-5.5.21-5.el6.x86_64.rpm php55-php-soap-5.5.21-5.el6.x86_64.rpm php55-php-tidy-5.5.21-5.el6.x86_64.rpm php55-php-xml-5.5.21-5.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: php55-php-5.5.21-5.el6.src.rpm x86_64: php55-php-5.5.21-5.el6.x86_64.rpm php55-php-bcmath-5.5.21-5.el6.x86_64.rpm php55-php-cli-5.5.21-5.el6.x86_64.rpm php55-php-common-5.5.21-5.el6.x86_64.rpm php55-php-dba-5.5.21-5.el6.x86_64.rpm php55-php-debuginfo-5.5.21-5.el6.x86_64.rpm php55-php-devel-5.5.21-5.el6.x86_64.rpm php55-php-enchant-5.5.21-5.el6.x86_64.rpm php55-php-fpm-5.5.21-5.el6.x86_64.rpm php55-php-gd-5.5.21-5.el6.x86_64.rpm php55-php-gmp-5.5.21-5.el6.x86_64.rpm php55-php-imap-5.5.21-5.el6.x86_64.rpm php55-php-intl-5.5.21-5.el6.x86_64.rpm php55-php-ldap-5.5.21-5.el6.x86_64.rpm php55-php-mbstring-5.5.21-5.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el6.x86_64.rpm php55-php-odbc-5.5.21-5.el6.x86_64.rpm php55-php-opcache-5.5.21-5.el6.x86_64.rpm php55-php-pdo-5.5.21-5.el6.x86_64.rpm php55-php-pgsql-5.5.21-5.el6.x86_64.rpm php55-php-process-5.5.21-5.el6.x86_64.rpm php55-php-pspell-5.5.21-5.el6.x86_64.rpm php55-php-recode-5.5.21-5.el6.x86_64.rpm php55-php-snmp-5.5.21-5.el6.x86_64.rpm php55-php-soap-5.5.21-5.el6.x86_64.rpm php55-php-tidy-5.5.21-5.el6.x86_64.rpm php55-php-xml-5.5.21-5.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: php55-php-5.5.21-5.el6.src.rpm x86_64: php55-php-5.5.21-5.el6.x86_64.rpm php55-php-bcmath-5.5.21-5.el6.x86_64.rpm php55-php-cli-5.5.21-5.el6.x86_64.rpm php55-php-common-5.5.21-5.el6.x86_64.rpm php55-php-dba-5.5.21-5.el6.x86_64.rpm php55-php-debuginfo-5.5.21-5.el6.x86_64.rpm php55-php-devel-5.5.21-5.el6.x86_64.rpm php55-php-enchant-5.5.21-5.el6.x86_64.rpm php55-php-fpm-5.5.21-5.el6.x86_64.rpm php55-php-gd-5.5.21-5.el6.x86_64.rpm php55-php-gmp-5.5.21-5.el6.x86_64.rpm php55-php-imap-5.5.21-5.el6.x86_64.rpm php55-php-intl-5.5.21-5.el6.x86_64.rpm php55-php-ldap-5.5.21-5.el6.x86_64.rpm php55-php-mbstring-5.5.21-5.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el6.x86_64.rpm php55-php-odbc-5.5.21-5.el6.x86_64.rpm php55-php-opcache-5.5.21-5.el6.x86_64.rpm php55-php-pdo-5.5.21-5.el6.x86_64.rpm php55-php-pgsql-5.5.21-5.el6.x86_64.rpm php55-php-process-5.5.21-5.el6.x86_64.rpm php55-php-pspell-5.5.21-5.el6.x86_64.rpm php55-php-recode-5.5.21-5.el6.x86_64.rpm php55-php-snmp-5.5.21-5.el6.x86_64.rpm php55-php-soap-5.5.21-5.el6.x86_64.rpm php55-php-tidy-5.5.21-5.el6.x86_64.rpm php55-php-xml-5.5.21-5.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: php55-php-5.5.21-5.el6.src.rpm x86_64: php55-php-5.5.21-5.el6.x86_64.rpm php55-php-bcmath-5.5.21-5.el6.x86_64.rpm php55-php-cli-5.5.21-5.el6.x86_64.rpm php55-php-common-5.5.21-5.el6.x86_64.rpm php55-php-dba-5.5.21-5.el6.x86_64.rpm php55-php-debuginfo-5.5.21-5.el6.x86_64.rpm php55-php-devel-5.5.21-5.el6.x86_64.rpm php55-php-enchant-5.5.21-5.el6.x86_64.rpm php55-php-fpm-5.5.21-5.el6.x86_64.rpm php55-php-gd-5.5.21-5.el6.x86_64.rpm php55-php-gmp-5.5.21-5.el6.x86_64.rpm php55-php-imap-5.5.21-5.el6.x86_64.rpm php55-php-intl-5.5.21-5.el6.x86_64.rpm php55-php-ldap-5.5.21-5.el6.x86_64.rpm php55-php-mbstring-5.5.21-5.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el6.x86_64.rpm php55-php-odbc-5.5.21-5.el6.x86_64.rpm php55-php-opcache-5.5.21-5.el6.x86_64.rpm php55-php-pdo-5.5.21-5.el6.x86_64.rpm php55-php-pgsql-5.5.21-5.el6.x86_64.rpm php55-php-process-5.5.21-5.el6.x86_64.rpm php55-php-pspell-5.5.21-5.el6.x86_64.rpm php55-php-recode-5.5.21-5.el6.x86_64.rpm php55-php-snmp-5.5.21-5.el6.x86_64.rpm php55-php-soap-5.5.21-5.el6.x86_64.rpm php55-php-tidy-5.5.21-5.el6.x86_64.rpm php55-php-xml-5.5.21-5.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: php55-php-5.5.21-5.el7.src.rpm x86_64: php55-php-5.5.21-5.el7.x86_64.rpm php55-php-bcmath-5.5.21-5.el7.x86_64.rpm php55-php-cli-5.5.21-5.el7.x86_64.rpm php55-php-common-5.5.21-5.el7.x86_64.rpm php55-php-dba-5.5.21-5.el7.x86_64.rpm php55-php-debuginfo-5.5.21-5.el7.x86_64.rpm php55-php-devel-5.5.21-5.el7.x86_64.rpm php55-php-enchant-5.5.21-5.el7.x86_64.rpm php55-php-fpm-5.5.21-5.el7.x86_64.rpm php55-php-gd-5.5.21-5.el7.x86_64.rpm php55-php-gmp-5.5.21-5.el7.x86_64.rpm php55-php-intl-5.5.21-5.el7.x86_64.rpm php55-php-ldap-5.5.21-5.el7.x86_64.rpm php55-php-mbstring-5.5.21-5.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el7.x86_64.rpm php55-php-odbc-5.5.21-5.el7.x86_64.rpm php55-php-opcache-5.5.21-5.el7.x86_64.rpm php55-php-pdo-5.5.21-5.el7.x86_64.rpm php55-php-pgsql-5.5.21-5.el7.x86_64.rpm php55-php-process-5.5.21-5.el7.x86_64.rpm php55-php-pspell-5.5.21-5.el7.x86_64.rpm php55-php-recode-5.5.21-5.el7.x86_64.rpm php55-php-snmp-5.5.21-5.el7.x86_64.rpm php55-php-soap-5.5.21-5.el7.x86_64.rpm php55-php-xml-5.5.21-5.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: php55-php-5.5.21-5.el7.src.rpm x86_64: php55-php-5.5.21-5.el7.x86_64.rpm php55-php-bcmath-5.5.21-5.el7.x86_64.rpm php55-php-cli-5.5.21-5.el7.x86_64.rpm php55-php-common-5.5.21-5.el7.x86_64.rpm php55-php-dba-5.5.21-5.el7.x86_64.rpm php55-php-debuginfo-5.5.21-5.el7.x86_64.rpm php55-php-devel-5.5.21-5.el7.x86_64.rpm php55-php-enchant-5.5.21-5.el7.x86_64.rpm php55-php-fpm-5.5.21-5.el7.x86_64.rpm php55-php-gd-5.5.21-5.el7.x86_64.rpm php55-php-gmp-5.5.21-5.el7.x86_64.rpm php55-php-intl-5.5.21-5.el7.x86_64.rpm php55-php-ldap-5.5.21-5.el7.x86_64.rpm php55-php-mbstring-5.5.21-5.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el7.x86_64.rpm php55-php-odbc-5.5.21-5.el7.x86_64.rpm php55-php-opcache-5.5.21-5.el7.x86_64.rpm php55-php-pdo-5.5.21-5.el7.x86_64.rpm php55-php-pgsql-5.5.21-5.el7.x86_64.rpm php55-php-process-5.5.21-5.el7.x86_64.rpm php55-php-pspell-5.5.21-5.el7.x86_64.rpm php55-php-recode-5.5.21-5.el7.x86_64.rpm php55-php-snmp-5.5.21-5.el7.x86_64.rpm php55-php-soap-5.5.21-5.el7.x86_64.rpm php55-php-xml-5.5.21-5.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: php55-php-5.5.21-5.el7.src.rpm x86_64: php55-php-5.5.21-5.el7.x86_64.rpm php55-php-bcmath-5.5.21-5.el7.x86_64.rpm php55-php-cli-5.5.21-5.el7.x86_64.rpm php55-php-common-5.5.21-5.el7.x86_64.rpm php55-php-dba-5.5.21-5.el7.x86_64.rpm php55-php-debuginfo-5.5.21-5.el7.x86_64.rpm php55-php-devel-5.5.21-5.el7.x86_64.rpm php55-php-enchant-5.5.21-5.el7.x86_64.rpm php55-php-fpm-5.5.21-5.el7.x86_64.rpm php55-php-gd-5.5.21-5.el7.x86_64.rpm php55-php-gmp-5.5.21-5.el7.x86_64.rpm php55-php-intl-5.5.21-5.el7.x86_64.rpm php55-php-ldap-5.5.21-5.el7.x86_64.rpm php55-php-mbstring-5.5.21-5.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el7.x86_64.rpm php55-php-odbc-5.5.21-5.el7.x86_64.rpm php55-php-opcache-5.5.21-5.el7.x86_64.rpm php55-php-pdo-5.5.21-5.el7.x86_64.rpm php55-php-pgsql-5.5.21-5.el7.x86_64.rpm php55-php-process-5.5.21-5.el7.x86_64.rpm php55-php-pspell-5.5.21-5.el7.x86_64.rpm php55-php-recode-5.5.21-5.el7.x86_64.rpm php55-php-snmp-5.5.21-5.el7.x86_64.rpm php55-php-soap-5.5.21-5.el7.x86_64.rpm php55-php-xml-5.5.21-5.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: php55-php-5.5.21-5.el7.src.rpm x86_64: php55-php-5.5.21-5.el7.x86_64.rpm php55-php-bcmath-5.5.21-5.el7.x86_64.rpm php55-php-cli-5.5.21-5.el7.x86_64.rpm php55-php-common-5.5.21-5.el7.x86_64.rpm php55-php-dba-5.5.21-5.el7.x86_64.rpm php55-php-debuginfo-5.5.21-5.el7.x86_64.rpm php55-php-devel-5.5.21-5.el7.x86_64.rpm php55-php-enchant-5.5.21-5.el7.x86_64.rpm php55-php-fpm-5.5.21-5.el7.x86_64.rpm php55-php-gd-5.5.21-5.el7.x86_64.rpm php55-php-gmp-5.5.21-5.el7.x86_64.rpm php55-php-intl-5.5.21-5.el7.x86_64.rpm php55-php-ldap-5.5.21-5.el7.x86_64.rpm php55-php-mbstring-5.5.21-5.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-5.el7.x86_64.rpm php55-php-odbc-5.5.21-5.el7.x86_64.rpm php55-php-opcache-5.5.21-5.el7.x86_64.rpm php55-php-pdo-5.5.21-5.el7.x86_64.rpm php55-php-pgsql-5.5.21-5.el7.x86_64.rpm php55-php-process-5.5.21-5.el7.x86_64.rpm php55-php-pspell-5.5.21-5.el7.x86_64.rpm php55-php-recode-5.5.21-5.el7.x86_64.rpm php55-php-snmp-5.5.21-5.el7.x86_64.rpm php55-php-soap-5.5.21-5.el7.x86_64.rpm php55-php-xml-5.5.21-5.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-5.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-5385 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXrPSuXlSAg2UNWIIRAmLnAKCBRe4E5DnZotwDu0Tb+ITqqiZ2nQCeI6jD V28z7ctkF+xOsCoI2ug8jtY= =n134 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Bug Fix(es): * Previously, an incorrect logic in the SAPI header callback routine caused that the callback counter was not incremented. Consequently, when a script included a header callback, it could terminate unexpectedly with a segmentation fault. With this update, the callback counter is properly managed, and scripts with a header callback implementation work as expected. (BZ#1346758) 4. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03770en_us SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: hpesbhf03770en_us Version: 1 HPESBHF03770 rev.1 - HPE Comware 7 MSR Routers using PHP, Go, Apache Http Server, and Tomcat, Remote Arbitrary Code Execution NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2017-08-21 Last Updated: 2017-08-21 Potential Security Impact: Remote: Arbitrary Code Execution Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified in Comware 7 MSR Routers using PHP, Go, Apache Http Server, and Tomcat. The vulnerability known as "httpoxy" could be remotely exploited to execute arbitrary code. - Comware v7 (CW7) Products V7 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-5385 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) CVE-2016-5386 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-5387 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) CVE-2016-5388 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has made the following software updates available to resolve the vulnerability in the Comware 7 MSR Router products: + **MSR1000 (Comware 7) - Version: Fixed in R0605P13 Release** * HP Network Products - JG875A HP MSR1002-4 AC Router - JH060A HP MSR1003-8S AC Router * CVE's/ZDI's - CVE-2016-5385 - CVE-2016-5386 - CVE-2016-5387 - CVE-2016-5388 + **MSR2000 (Comware 7) - Version: Fixed in R0605P13 Release** * HP Network Products - JG411A HP MSR2003 AC Router - JG734A HP MSR2004-24 AC Router - JG735A HP MSR2004-48 Router - JG866A HP MSR2003 TAA-compliant AC Router * CVE's/ZDI's - CVE-2016-5385 - CVE-2016-5386 - CVE-2016-5387 - CVE-2016-5388 + **MSR3000 (Comware 7) - Version: Fixed in R0605P13 Release** * HP Network Products - JG404A HP MSR3064 Router - JG405A HP MSR3044 Router - JG406A HP MSR3024 AC Router - JG407A HP MSR3024 DC Router - JG408A HP MSR3024 PoE Router - JG409A HP MSR3012 AC Router - JG410A HP MSR3012 DC Router - JG861A HP MSR3024 TAA-compliant AC Router - JG409B HPE MSR3012 AC Router * CVE's/ZDI's - CVE-2016-5385 - CVE-2016-5386 - CVE-2016-5387 - CVE-2016-5388 + **MSR4000 (Comware 7) - Version: Fixed in R0605P13 Release** * HP Network Products - JG402A HP MSR4080 Router Chassis - JG403A HP MSR4060 Router Chassis - JG412A HP MSR4000 MPU-100 Main Processing Unit - JG869A HP MSR4000 TAA-compliant MPU-100 Main Processing Unit * CVE's/ZDI's - CVE-2016-5385 - CVE-2016-5386 - CVE-2016-5387 - CVE-2016-5388 + **MSR95X (Comware 7) - Version: Fixed in R0605P13 Release** * HP Network Products - JH296A HPE MSR954 1GbE SFP 2GbE-WAN 4GbE-LAN CWv7 Router - JH297A HPE MSR954-W 1GbE SFP (WW) 2GbE-WAN 4GbE-LAN Wireless 802.11n CWv7 Router - JH298A HPE MSR954-W 1GbE SFP LTE (AM) 2GbE-WAN 4GbE-LAN Wireless 802.11n CWv7 Router - JH299A HPE MSR954-W 1GbE SFP LTE (WW) 2GbE-WAN 4GbE-LAN Wireless 802.11n CWv7 Router - JH300A HPE FlexNetwork MSR958 1GbE and Combo 2GbE WAN 8GbE LAN Router - JH301A HPE FlexNetwork MSR958 1GbE and Combo 2GbE WAN 8GbE LAN PoE Router - JH373A HPE MSR954 Serial 1GbE Dual 4GLTE (WW) CWv7 Router * CVE's/ZDI's - CVE-2016-5385 - CVE-2016-5386 - CVE-2016-5387 - CVE-2016-5388 *Note:* Please contact support for any questions about this document HISTORY Version:1 (rev.1) - 21 August 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners

Trust: 3.15

sources: NVD: CVE-2016-5385 // CERT/CC: VU#797896 // JVNDB: JVNDB-2016-003800 // BID: 91821 // VULHUB: VHN-94204 // VULMON: CVE-2016-5385 // PACKETSTORM: 138070 // PACKETSTORM: 138297 // PACKETSTORM: 138299 // PACKETSTORM: 143933

AFFECTED PRODUCTS

vendor:	hewlett packard	model:	storeever msl6480 tape library	scope:	-	version:	-	Trust: 1.6
vendor:	oracle	model:	linux	scope:	eq	version:	6	Trust: 1.3
vendor:	oracle	model:	linux	scope:	eq	version:	7	Trust: 1.3
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	10.0.1	Trust: 1.3
vendor:	redhat	model:	enterprise linux workstation	scope:	eq	version:	6.0	Trust: 1.0
vendor:	redhat	model:	enterprise linux server	scope:	eq	version:	6.0	Trust: 1.0
vendor:	oracle	model:	enterprise manager ops center	scope:	eq	version:	12.3.2	Trust: 1.0
vendor:	oracle	model:	enterprise manager ops center	scope:	eq	version:	12.2.2	Trust: 1.0
vendor:	php	model:	php	scope:	gte	version:	5.6.0	Trust: 1.0
vendor:	drupal	model:	drupal	scope:	gte	version:	8.0.0	Trust: 1.0
vendor:	opensuse	model:	leap	scope:	eq	version:	42.1	Trust: 1.0
vendor:	php	model:	php	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	php	model:	php	scope:	lte	version:	7.0.8	Trust: 1.0
vendor:	hp	model:	storeever msl6480 tape library	scope:	lte	version:	5.09	Trust: 1.0
vendor:	php	model:	php	scope:	lt	version:	5.5.38	Trust: 1.0
vendor:	php	model:	php	scope:	lt	version:	5.6.24	Trust: 1.0
vendor:	redhat	model:	enterprise linux desktop	scope:	eq	version:	6.0	Trust: 1.0
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	10.0.0	Trust: 1.0
vendor:	drupal	model:	drupal	scope:	lt	version:	8.1.7	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	23	Trust: 1.0
vendor:	hp	model:	system management homepage	scope:	lte	version:	7.5.5.0	Trust: 1.0
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	debian	model:	linux	scope:	eq	version:	8.0	Trust: 1.0
vendor:	php	model:	php	scope:	gte	version:	5.5.0	Trust: 1.0
vendor:	fedoraproject	model:	fedora	scope:	eq	version:	24	Trust: 1.0
vendor:	apache http server	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	go programming language	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	haproxy	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	hhvm	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	microsoft	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	python	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	the php group	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	lighttpd	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	nginx	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	fedora	model:	fedora	scope:	-	version:	-	Trust: 0.8
vendor:	the php group	model:	php	scope:	lte	version:	7.0.8	Trust: 0.8
vendor:	oracle	model:	linux	scope:	-	version:	-	Trust: 0.8
vendor:	hewlett packard	model:	system management homepage	scope:	-	version:	-	Trust: 0.8
vendor:	nec	model:	webotx	scope:	eq	version:	enterprise edition v4.1 to v6.5	Trust: 0.8
vendor:	nec	model:	webotx	scope:	eq	version:	standard edition v4.1 to v6.5	Trust: 0.8
vendor:	nec	model:	webotx	scope:	eq	version:	standard-j edition v4.1 to v6.5	Trust: 0.8
vendor:	nec	model:	webotx	scope:	eq	version:	web edition v4.1 to v6.5	Trust: 0.8
vendor:	nec	model:	webotx	scope:	eq	version:	development environment v6.1 to v6.5	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	enterprise v8.2 to v9.4	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	express v8.2 to v9.4	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	foundation v8.2 to v8.5	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	standard v8.2 to v9.4	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	standard-j edition v7.1 to v8.1	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	web edition v7.1 to v8.1	Trust: 0.8
vendor:	nec	model:	webotx developer	scope:	eq	version:	"(with developers studio) v8.2 to v9.4"	Trust: 0.8
vendor:	nec	model:	webotx developer	scope:	eq	version:	v7.1 to v8.1	Trust: 0.8
vendor:	nec	model:	webotx enterprise service bus	scope:	eq	version:	v6.4 to v9.3	Trust: 0.8
vendor:	nec	model:	webotx portal	scope:	eq	version:	v8.2 to v9.3	Trust: 0.8
vendor:	nec	model:	webotx sip application server	scope:	eq	version:	standard edition v7.1 to v8.1	Trust: 0.8
vendor:	oracle	model:	linux	scope:	eq	version:	7.0	Trust: 0.6
vendor:	hp	model:	storeever msl6480 tape library	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	storeever msl6480 tape library	scope:	eq	version:	4.90	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.2	Trust: 0.3
vendor:	ibm	model:	tealeaf customer experience on cloud network capture add-on	scope:	eq	version:	16.1.01	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	eq	version:	8.1	Trust: 0.3
vendor:	ibm	model:	api connect	scope:	eq	version:	5.0.3.0	Trust: 0.3
vendor:	ibm	model:	smartcloud entry	scope:	eq	version:	2.3.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.1	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.8	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	ne	version:	2.1.1.3-65.12	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.20	Trust: 0.3
vendor:	ibm	model:	powerkvm update	scope:	ne	version:	3.1.0.22	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.6	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.23	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fp	scope:	eq	version:	3.1.0.4	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.5	Trust: 0.3
vendor:	php	model:	php	scope:	ne	version:	7.0.9	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	eq	version:	3.1	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	3.13	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	ne	version:	8.2.1	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	ne	version:	7.6	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fix pack	scope:	eq	version:	2.24	Trust: 0.3
vendor:	hp	model:	storeever msl6480 tape library	scope:	eq	version:	4.40	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.14	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.4	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.5	Trust: 0.3
vendor:	ibm	model:	powerkvm sp3	scope:	eq	version:	2.1.1	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.165.4	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.2	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.165.6	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.1.0	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	eq	version:	2.1.1.3-65	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fi	scope:	eq	version:	2.2.0.4	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	eq	version:	8.1.1	Trust: 0.3
vendor:	ibm	model:	powerkvm sp2	scope:	eq	version:	3.1	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.5	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.13	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.1.5	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.1	Trust: 0.3
vendor:	guzzle	model:	guzzle	scope:	ne	version:	6.2.1	Trust: 0.3
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	10.2	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.165.1	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fix pack	scope:	eq	version:	2.36	Trust: 0.3
vendor:	oracle	model:	solaris	scope:	eq	version:	11.3	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.1.4	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.157	Trust: 0.3
vendor:	guzzle	model:	guzzle	scope:	eq	version:	5	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.8	Trust: 0.3
vendor:	ibm	model:	powerkvm update	scope:	eq	version:	3.1.0.21	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.7	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.21	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.1.3	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	eq	version:	8.0.1	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	3.12	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.0	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.4	Trust: 0.3
vendor:	gentoo	model:	linux	scope:	-	version:	-	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.165.5	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	eq	version:	3.1.0.2	Trust: 0.3
vendor:	ibm	model:	api connect	scope:	eq	version:	5.0.1.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.2	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.0.3	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.10	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.6	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.0.2	Trust: 0.3
vendor:	ibm	model:	api connect	scope:	eq	version:	5.0.2.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.3	Trust: 0.3
vendor:	ibm	model:	powerkvm sp1	scope:	eq	version:	3.1	Trust: 0.3
vendor:	guzzle	model:	guzzle	scope:	eq	version:	6	Trust: 0.3
vendor:	ibm	model:	smartcloud entry	scope:	eq	version:	2.4.0	Trust: 0.3
vendor:	php	model:	php	scope:	ne	version:	5.6.24	Trust: 0.3
vendor:	hp	model:	storeever msl6480 tape library	scope:	ne	version:	5.10	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fix pack	scope:	eq	version:	2.34	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	eq	version:	8.0.0	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	ne	version:	8.1.7	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.9	Trust: 0.3
vendor:	guzzle	model:	4.0.0-rc2	scope:	-	version:	-	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fix pack	scope:	eq	version:	2.26	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.165.7	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.0.4	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	6.0	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.19	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.3	Trust: 0.3
vendor:	ibm	model:	smartcloud entry	scope:	eq	version:	3.2	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fi	scope:	eq	version:	2.4.0.4	Trust: 0.3
vendor:	ibm	model:	smartcloud entry	scope:	eq	version:	2.2	Trust: 0.3
vendor:	hp	model:	storeever msl6480 tape library	scope:	eq	version:	4.10	Trust: 0.3
vendor:	typo3	model:	typo3	scope:	eq	version:	8.2	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.4	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.11	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.3	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fp	scope:	eq	version:	3.2.0.4	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.18	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.17	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.22	Trust: 0.3
vendor:	ibm	model:	api connect	scope:	eq	version:	5.0.0.1	Trust: 0.3
vendor:	hp	model:	system management homepage	scope:	eq	version:	7.1	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	7.0.7	Trust: 0.3
vendor:	ibm	model:	smartcloud entry	scope:	eq	version:	3.1	Trust: 0.3
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	12.0	Trust: 0.3
vendor:	ibm	model:	smartcloud entry appliance fi	scope:	eq	version:	2.3.0.4	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	eq	version:	2.1.1.3-65.11	Trust: 0.3
vendor:	php	model:	php	scope:	eq	version:	5.6.12	Trust: 0.3
vendor:	guzzle	model:	guzzle	scope:	eq	version:	5.3	Trust: 0.3
vendor:	drupal	model:	drupal	scope:	eq	version:	8.1.6	Trust: 0.3
vendor:	oracle	model:	communications user data repository	scope:	eq	version:	10.0	Trust: 0.3
vendor:	ibm	model:	powerkvm build	scope:	eq	version:	2.1.158	Trust: 0.3
vendor:	ibm	model:	powerkvm	scope:	eq	version:	2.1.1.3-65.10	Trust: 0.3

sources: CERT/CC: VU#797896 // BID: 91821 // JVNDB: JVNDB-2016-003800 // CNNVD: CNNVD-201607-538 // NVD: CVE-2016-5385

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-5385
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-5385
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201607-538
value:	HIGH
Trust: 0.6
VULHUB:	VHN-94204
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2016-5385
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-5385
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-94204
severity:	MEDIUM
baseScore:	5.1
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	4.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-5385
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.2
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2016-5385
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-94204 // VULMON: CVE-2016-5385 // JVNDB: JVNDB-2016-003800 // CNNVD: CNNVD-201607-538 // NVD: CVE-2016-5385

PROBLEMTYPE DATA

problemtype:	CWE-601	Trust: 1.1
problemtype:	CWE-Other	Trust: 0.8
problemtype:	CWE-284	Trust: 0.1

sources: VULHUB: VHN-94204 // JVNDB: JVNDB-2016-003800 // NVD: CVE-2016-5385

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 138297 // PACKETSTORM: 138299 // CNNVD: CNNVD-201607-538

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201607-538

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-003800

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-94204

PATCH

title:	FEDORA-2016-4e7db3d437	url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/	Trust: 0.8
title:	FEDORA-2016-8eb11666aa	url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/	Trust: 0.8
title:	FEDORA-2016-9c8cf5912c	url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/	Trust: 0.8
title:	HPSBMU03653	url:	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05320149	Trust: 0.8
title:	HPSBST03671	url:	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05333297	Trust: 0.8
title:	NV16-020	url:	http://jpn.nec.com/security-info/secinfo/nv16-020.html	Trust: 0.8
title:	Oracle Linux Bulletin - July 2016	url:	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Trust: 0.8
title:	Bug 1353794	url:	https://bugzilla.redhat.com/show_bug.cgi?id=1353794	Trust: 0.8
title:	RHSA-2016:1609	url:	http://rhn.redhat.com/errata/RHSA-2016-1609.html	Trust: 0.8
title:	RHSA-2016:1610	url:	http://rhn.redhat.com/errata/RHSA-2016-1610.html	Trust: 0.8
title:	RHSA-2016:1611	url:	http://rhn.redhat.com/errata/RHSA-2016-1611.html	Trust: 0.8
title:	RHSA-2016:1612	url:	http://rhn.redhat.com/errata/RHSA-2016-1612.html	Trust: 0.8
title:	RHSA-2016:1613	url:	http://rhn.redhat.com/errata/RHSA-2016-1613.html	Trust: 0.8
title:	Top Page	url:	http://php.net/	Trust: 0.8
title:	TLSA-2016-19	url:	http://www.turbolinux.co.jp/security/2016/TLSA-2016-19j.html	Trust: 0.8
title:	PHP CGI Web server httpoxy Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=62998	Trust: 0.6
title:	The Register	url:	https://www.theregister.co.uk/2016/07/18/httpoxy_hole/	Trust: 0.2
title:	Amazon Linux AMI: ALAS-2016-728	url:	https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2016-728	Trust: 0.1
title:	Ubuntu Security Notice: php5, php7.0 vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3045-1	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a22ad41e97bbfc5abb0bb927bf43089c	Trust: 0.1
title:	Forcepoint Security Advisories: HTTPoxy CGI HTTP_PROXY Variable Multiple Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=forcepoint_security_advisories&qid=47734ce563632c9864b0b698ae37ddf9	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - July 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=2f446a7e1ea263c0c3a365776c6713f2	Trust: 0.1
title:	Oracle Linux Bulletins: Oracle Linux Bulletin - July 2016	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=0bd8c924b56aac98dda0f5b45f425f38	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - January 2018	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=e2a7f287e9acc8c64ab3df71130bc64d	Trust: 0.1
title:	bach	url:	https://github.com/sonatype-nexus-community/bach	Trust: 0.1
title:	bach	url:	https://github.com/OSSIndex/bach	Trust: 0.1
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2016-5385	Trust: 0.1
title:	jbot	url:	https://github.com/jschauma/jbot	Trust: 0.1
title:	CVE-2016-5385	url:	https://github.com/AIPOCAI/CVE-2016-5385	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/chaplean/nginx-proxy	Trust: 0.1
title:	nginx-proxy2	url:	https://github.com/corzel/nginx-proxy2	Trust: 0.1
title:	Test	url:	https://github.com/Abhinav4git/Test	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/jwilder/nginx-proxy	Trust: 0.1
title:	-	url:	https://github.com/GloveofGames/hehe	Trust: 0.1
title:	-	url:	https://github.com/jquepi/nginx-proxy-2	Trust: 0.1
title:	-	url:	https://github.com/lemonhope-mz/replica_nginx-proxy	Trust: 0.1
title:	reto-ejercicio1	url:	https://github.com/QuirianCordova/reto-ejercicio1	Trust: 0.1
title:	nginx	url:	https://github.com/ratika-web/nginx	Trust: 0.1
title:	docker-nginx-proxy	url:	https://github.com/CodeKoalas/docker-nginx-proxy	Trust: 0.1
title:	jwilder-nginx-proxy	url:	https://github.com/linguamerica/jwilder-nginx-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/abhi1693/nginx-proxy	Trust: 0.1
title:	DockerProject	url:	https://github.com/antoinechab/DockerProject	Trust: 0.1
title:	plonevhost	url:	https://github.com/alteroo/plonevhost	Trust: 0.1
title:	nginx-proxy-docker-image-builder	url:	https://github.com/expoli/nginx-proxy-docker-image-builder	Trust: 0.1
title:	reto-ejercicio3	url:	https://github.com/QuirianCordova/reto-ejercicio3	Trust: 0.1
title:	nginx	url:	https://github.com/isaiahweeks/nginx	Trust: 0.1
title:	docker-dev-tools-proxy	url:	https://github.com/antimatter-studios/docker-dev-tools-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/nginx-proxy/nginx-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/bfirestone/nginx-proxy	Trust: 0.1
title:	nginx-oidc-proxy	url:	https://github.com/garnser/nginx-oidc-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/VitasL/nginx-proxy	Trust: 0.1
title:	nginx-proxy-docker-image-builder	url:	https://github.com/expoli/nginx-proxy-docker-image	Trust: 0.1
title:	docker-proxy	url:	https://github.com/antimatter-studios/docker-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/junkl-solbox/nginx-proxy	Trust: 0.1
title:	nginxProxy	url:	https://github.com/moewsystem/nginxProxy	Trust: 0.1
title:	kube-active-proxy	url:	https://github.com/adi90x/kube-active-proxy	Trust: 0.1
title:	nginx-proxy	url:	https://github.com/antimatter-studios/nginx-proxy	Trust: 0.1
title:	-	url:	https://github.com/6d617274696e73/nginx-waf-proxy	Trust: 0.1
title:	-	url:	https://github.com/mikediamanto/nginx-proxy	Trust: 0.1
title:	rancher-active-proxy	url:	https://github.com/adi90x/rancher-active-proxy	Trust: 0.1
title:	algm-php-vulnerability-checker	url:	https://github.com/timclifford/algm-php-vulnerability-checker	Trust: 0.1
title:	-	url:	https://github.com/t0m4too/t0m4to	Trust: 0.1
title:	github_aquasecurity_trivy	url:	https://github.com/back8/github_aquasecurity_trivy	Trust: 0.1
title:	TrivyWeb	url:	https://github.com/KorayAgaya/TrivyWeb	Trust: 0.1
title:	Vulnerability-Scanner-for-Containers	url:	https://github.com/t31m0/Vulnerability-Scanner-for-Containers	Trust: 0.1
title:	security	url:	https://github.com/umahari/security	Trust: 0.1
title:	-	url:	https://github.com/Mohzeela/external-secret	Trust: 0.1
title:	trivy	url:	https://github.com/simiyo/trivy	Trust: 0.1
title:	trivy	url:	https://github.com/aquasecurity/trivy	Trust: 0.1
title:	trivy	url:	https://github.com/knqyf263/trivy	Trust: 0.1
title:	trivy	url:	https://github.com/siddharthraopotukuchi/trivy	Trust: 0.1
title:	Threatpost	url:	https://threatpost.com/cgi-script-vulnerability-httpoxy-allows-man-in-the-middle-attacks/119345/	Trust: 0.1

sources: VULMON: CVE-2016-5385 // JVNDB: JVNDB-2016-003800 // CNNVD: CNNVD-201607-538

EXTERNAL IDS

db:	CERT/CC	id:	VU#797896	Trust: 3.7
db:	NVD	id:	CVE-2016-5385	Trust: 3.3
db:	BID	id:	91821	Trust: 2.1
db:	SECTRACK	id:	1036335	Trust: 1.8
db:	JVN	id:	JVNVU91485132	Trust: 0.8
db:	JVNDB	id:	JVNDB-2016-003800	Trust: 0.8
db:	CNNVD	id:	CNNVD-201607-538	Trust: 0.7
db:	PACKETSTORM	id:	143933	Trust: 0.2
db:	PACKETSTORM	id:	138299	Trust: 0.2
db:	PACKETSTORM	id:	138297	Trust: 0.2
db:	PACKETSTORM	id:	138070	Trust: 0.2
db:	PACKETSTORM	id:	138295	Trust: 0.1
db:	PACKETSTORM	id:	138298	Trust: 0.1
db:	PACKETSTORM	id:	139744	Trust: 0.1
db:	PACKETSTORM	id:	138014	Trust: 0.1
db:	PACKETSTORM	id:	138296	Trust: 0.1
db:	VULHUB	id:	VHN-94204	Trust: 0.1
db:	VULMON	id:	CVE-2016-5385	Trust: 0.1

sources: CERT/CC: VU#797896 // VULHUB: VHN-94204 // VULMON: CVE-2016-5385 // BID: 91821 // JVNDB: JVNDB-2016-003800 // PACKETSTORM: 138070 // PACKETSTORM: 138297 // PACKETSTORM: 138299 // PACKETSTORM: 143933 // CNNVD: CNNVD-201607-538 // NVD: CVE-2016-5385

REFERENCES

url:	http://www.kb.cert.org/vuls/id/797896	Trust: 3.0
url:	http://www.securityfocus.com/bid/91821	Trust: 2.4
url:	http://www.debian.org/security/2016/dsa-3631	Trust: 2.4
url:	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Trust: 2.1
url:	http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html	Trust: 2.1
url:	https://bugzilla.redhat.com/show_bug.cgi?id=1353794	Trust: 2.1
url:	https://www.drupal.org/sa-core-2016-003	Trust: 2.1
url:	https://httpoxy.org/	Trust: 2.0
url:	http://rhn.redhat.com/errata/rhsa-2016-1611.html	Trust: 1.9
url:	http://rhn.redhat.com/errata/rhsa-2016-1613.html	Trust: 1.9
url:	http://www.securitytracker.com/id/1036335	Trust: 1.8
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/kzoiuyzdbwnddhc6xtolzyrmrxzwtjcp/	Trust: 1.8
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7rmyxavnyl2mobjtfate73tovoezyc5r/	Trust: 1.8
url:	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/gxfeimzpsvgzqqayiq7u7dfvx3ibsdlf/	Trust: 1.8
url:	https://security.gentoo.org/glsa/201611-22	Trust: 1.8
url:	http://rhn.redhat.com/errata/rhsa-2016-1609.html	Trust: 1.8
url:	http://rhn.redhat.com/errata/rhsa-2016-1610.html	Trust: 1.8
url:	http://rhn.redhat.com/errata/rhsa-2016-1612.html	Trust: 1.8
url:	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Trust: 1.8
url:	https://github.com/guzzle/guzzle/releases/tag/6.2.1	Trust: 1.8
url:	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05320149	Trust: 1.8
url:	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05333297	Trust: 1.8
url:	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05390722	Trust: 1.8
url:	http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html	Trust: 1.8
url:	https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbhf03770en_us	Trust: 1.7
url:	https://www.apache.org/security/asf-httpoxy-response.txt	Trust: 1.6
url:	https://tools.ietf.org/html/rfc3875	Trust: 0.8
url:	https://httpoxy.org	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/807.html	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/454.html	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5385	Trust: 0.8
url:	http://jvn.jp/cert/jvnvu91485132	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5385	Trust: 0.8
url:	https://access.redhat.com/security/cve/cve-2016-5385	Trust: 0.8
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7rmyxavnyl2mobjtfate73tovoezyc5r/	Trust: 0.6
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/gxfeimzpsvgzqqayiq7u7dfvx3ibsdlf/	Trust: 0.6
url:	https://access.redhat.com/errata/rhsa-2016:1613	Trust: 0.6
url:	https://access.redhat.com/errata/rhsa-2016:1612	Trust: 0.6
url:	https://access.redhat.com/errata/rhsa-2016:1611	Trust: 0.6
url:	https://access.redhat.com/errata/rhsa-2016:1610	Trust: 0.6
url:	https://access.redhat.com/errata/rhsa-2016:1609	Trust: 0.6
url:	httpoxy.org/	Trust: 0.6
url:	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/kzoiuyzdbwnddhc6xtolzyrmrxzwtjcp/	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2016-5385	Trust: 0.4
url:	https://github.com/friendsofphp/security-advisories/commit/7ed8f8e3a87f7be13dd70cccd54f8701be1be6e0	Trust: 0.3
url:	http://www.php.net/	Trust: 0.3
url:	https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05320149	Trust: 0.3
url:	https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05333297	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=isg3t1024261	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=isg3t1024735	Trust: 0.3
url:	https://www.oracle.com/technetwork/topics/security/bulletinjul2017-3814622.html	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg21993929	Trust: 0.3
url:	http://www.ibm.com/support/docview.wss?uid=swg21994534	Trust: 0.3
url:	https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-019/	Trust: 0.3
url:	https://www.redhat.com/mailman/listinfo/rhsa-announce	Trust: 0.2
url:	https://bugzilla.redhat.com/):	Trust: 0.2
url:	https://access.redhat.com/security/team/key/	Trust: 0.2
url:	https://access.redhat.com/articles/11258	Trust: 0.2
url:	https://access.redhat.com/security/updates/classification/#moderate	Trust: 0.2
url:	https://access.redhat.com/security/team/contact/	Trust: 0.2
url:	https://h20566.www2.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbhf03770en_us	Trust: 0.1
url:	https://cwe.mitre.org/data/definitions/601.html	Trust: 0.1
url:	https://github.com/sonatype-nexus-community/bach	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-5399	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6294	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6289	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6297	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6291	Trust: 0.1
url:	https://php.net/changelog-5.php#5.6.24	Trust: 0.1
url:	https://www.debian.org/security/faq	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6292	Trust: 0.1
url:	https://www.debian.org/security/	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6295	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6296	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6290	Trust: 0.1
url:	https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-hpesbhf03770en_us	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-5387	Trust: 0.1
url:	http://www.hpe.com/support/security_bulletin_archive	Trust: 0.1
url:	https://www.hpe.com/info/report-security-vulnerability	Trust: 0.1
url:	http://www.hpe.com/support/subscriber_choice	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-5388	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-5386	Trust: 0.1
url:	https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499	Trust: 0.1

CREDITS

Scott Geary (VendHQ)

Trust: 0.3

sources: BID: 91821

SOURCES

db:	CERT/CC	id:	VU#797896
db:	VULHUB	id:	VHN-94204
db:	VULMON	id:	CVE-2016-5385
db:	BID	id:	91821
db:	JVNDB	id:	JVNDB-2016-003800
db:	PACKETSTORM	id:	138070
db:	PACKETSTORM	id:	138297
db:	PACKETSTORM	id:	138299
db:	PACKETSTORM	id:	143933
db:	CNNVD	id:	CNNVD-201607-538
db:	NVD	id:	CVE-2016-5385

LAST UPDATE DATE

2025-01-28T19:56:13.826000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#797896	date:	2016-07-19T00:00:00
db:	VULHUB	id:	VHN-94204	date:	2023-02-12T00:00:00
db:	VULMON	id:	CVE-2016-5385	date:	2023-02-12T00:00:00
db:	BID	id:	91821	date:	2018-01-18T09:00:00
db:	JVNDB	id:	JVNDB-2016-003800	date:	2016-12-27T00:00:00
db:	CNNVD	id:	CNNVD-201607-538	date:	2023-04-03T00:00:00
db:	NVD	id:	CVE-2016-5385	date:	2024-11-21T02:54:12.637

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#797896	date:	2016-07-18T00:00:00
db:	VULHUB	id:	VHN-94204	date:	2016-07-19T00:00:00
db:	VULMON	id:	CVE-2016-5385	date:	2016-07-19T00:00:00
db:	BID	id:	91821	date:	2016-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2016-003800	date:	2016-07-25T00:00:00
db:	PACKETSTORM	id:	138070	date:	2016-07-27T14:25:39
db:	PACKETSTORM	id:	138297	date:	2016-08-12T18:03:14
db:	PACKETSTORM	id:	138299	date:	2016-08-12T18:03:29
db:	PACKETSTORM	id:	143933	date:	2017-08-28T21:22:00
db:	CNNVD	id:	CNNVD-201607-538	date:	2016-07-19T00:00:00
db:	NVD	id:	CVE-2016-5385	date:	2016-07-19T02:00:17.773