CVE-2016-5386: High severity red hat fedora vulnerability
Dominic Scheirlinck of VendHQ reports:
Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTPPROXY” environmental variable based on the header value. When this variable is used (in many cases automatically by various HTTP client libraries) any outgoing requests generated in turn from the attackers original request can be redirected to an attacker controlled proxy. This allows attackers to view potentially sensitive information, reply with malformed data, or to hold connections open causing a potential denial of service.
The Go programming language can automatically populate the HTTPPROXY environmental variable with a user supplied "Proxy" header.
Other sources
Google Go net/http package could allow a remote attacker to redirect HTTP traffic of CGI application, caused by the failure to protect applications from the presence of untrusted client data in the HTTPPROXY environment variable. By using a specially-crafted Proxy header in a HTTP request, an attacker could exploit this vulnerability to redirect outbound HTTP traffic to arbitrary proxy server.
This is also known as the "HTTPOXY" vulnerability.
— IBM
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5386?
CVE-2016-5386 has a medium severity rating due to its potential impact on affected systems.
How do I fix CVE-2016-5386?
To fix CVE-2016-5386, you should upgrade the Go programming language to versions 1.6.3 or 1.7 or higher.
Which software versions are affected by CVE-2016-5386?
CVE-2016-5386 affects Go programming language versions prior to 1.6.3 and 1.7.
Is CVE-2016-5386 a remote vulnerability?
Yes, CVE-2016-5386 can be exploited remotely through manipulated proxy headers.
Who reported CVE-2016-5386?
CVE-2016-5386 was reported by Dominic Scheirlinck of VendHQ.