1635 matches found
SUSE-SU-2016:1842-1 Security update for php5
This update for php5 fixes the following issues: It is possible to launch a web server with 'php -S localhost:8080' It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request...
[SECURITY] [DSA 3623-1] apache2 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3623-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 20, 2016 https://www.debian.org/security/faq -...
CVE-2016-5386
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI...
Design/Logic Flaw
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI...
GO Language httpoxy Remote Proxy Infection Vulnerability
Go language is the second open source programming language released by Google. httpoxy is a set of vulnerabilities that affect application code running in a CGI environment. The vulnerabilities exist primarily in multiple web servers, web frameworks, and programming languages. The Proxy field nam...
CGI Namespace Conflict Man-In-The-Middle (httpoxy; CVE-2016-1000109; CVE-2016-1000110; CVE-2016-5385; CVE-2016-5386; CVE-2016-5387; CVE-2016-5388)
Namespace conflict related to HTTP proxy headers allows an attacker to configure the HTTPPROXY environment variable. A successful exploitation might allow an attacker to launch a man-in-the-middle attack and redirect traffic to an arbitrary host...
FreeBSD : Multiple ports -- Proxy HTTP header vulnerability (httpoxy) (cf0b5668-4d1b-11e6-b2ec-b499baebfeaf)
httpoxy.org reports : httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict:. - RFC 3875 CGI puts the HTTP Proxy header from a request into the environment variables as HTTPPROXY - HTTPPROXY is a...
HTTP Proxy header vulnerability
Bug Fixes Removed support for using HTTPPROXY environment variable for non-CLI apps per CVE-2016-5385 httpoxy. Graham Campbell 143 145 Convert BUGSNAGNOTIFYRELEASESTAGES to a comma-delimited array Jason Graham Campbell 142 144...
HTTP Proxy header vulnerability
Bug Fixes - Removed support for using HTTPPROXY environment variable for non-CLI apps per CVE-2016-5385 httpoxy. Graham Campbell 143 145 - Convert BUGSNAGNOTIFYRELEASESTAGES to a comma-delimited array Jason Graham Campbell 142 144...
USN-3038-1 apache2 vulnerability
It was discovered that the Apache HTTP Server would set the HTTPPROXY environment variable based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this issue in combination with CGI scripts that honour the HTTPPROXY variable to redirect outgoing HTTP...
CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack
An old scripting vulnerability that impacts a large number of Linux distributions and programing languages allows for man-in-the-middle attacks that could compromise web servers. The vulnerability, which affects many PHP and CGI web-apps, was revealed Monday in tandem with the release of a bevy...
HTTP Proxy header vulnerability
More info at https://twitter.com/asyncphp/status/755136084917583872...
SUSE-SU-2016:1819-1 Security update for apache2
This update for apache2 fixes the following issues: It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...
SUSE-SU-2016:1820-1 Security update for apache2-mod_fcgid
This update for apache2-modfcgid fixes the following issues: It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-1000104. As a result, these server components...
PT-2016-6400
Name of the Vulnerable Software and Affected Versions Go versions through 1.6 Description The issue allows remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This is due to the failure to address RFC...
PT-2016-6399
Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.0.9 Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request. This can be achieved by exploiting the...
Multiple ports -- Proxy HTTP header vulnerability (httpoxy)
httpoxy.org reports: httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict:. RFC 3875 CGI puts the HTTP Proxy header from a request into the environment variables as HTTPPROXY HTTPPROXY is a popular...
PT-2016-6401
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.25 Apache HTTP Server versions prior to 2.2.32 Description The issue allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in...
HTTP Proxy header vulnerability
Addressing HTTPPROXY security vulnerability, CVE-2016-5385: https://httpoxy.org/. Please update to this version of Guzzle in order to mitigate the vulnerability when sending Guzzle requests inside of a CGI application. - Fixing timeout bug with StreamHandler - Only read up to Content-Length in...
Squid HTTP Proxy Server Data Compromise
The vulnerability in HttpHdrRange.cc in Squid allows malicious actors to induce a service failure by sending requests containing specially crafted Range headers with unidentified byte-range values...