The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Bouncy Castle Java library due to     improper validation of a point within the elliptic     curve. An unauthenticated, remote attacker can exploit     this to obtain private keys by using a series of     specially crafted elliptic curve Diffie-Hellman (ECDH)     key exchanges, also known as an 'invalid curve attack.'     (CVE-2015-7940)

  - A flaw exists in the PathTools module for Perl in the     File::Spec::canonpath() function that is triggered as     strings are returned as untainted even when passing     tainted input. An unauthenticated, remote attacker can     exploit this to pass unvalidated user input to sensitive     or insecure areas. (CVE-2015-8607)

  - An overflow condition exists in Perl in the MapPathA()     function due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-8608)

  - A remote code execution vulnerability exists in the     Apache Struts component due to improper handling of     multithreaded access to an ActionForm instance. An     unauthenticated, remote attacker can exploit this, via a     specially crafted multipart request, to execute     arbitrary code or cause a denial of service condition.
    (CVE-2016-1181)

  - A flaw exists in Perl that is triggered during the     handling of variables that appear twice in the     environment (envp), causing the last value to appear in     %ENV, while getenv would return the first. An     unauthenticated, remote attacker can exploit this to     cause variables to be incorrectly propagated to     subprocesses, regardless of the protections offered by     taint checking. (CVE-2016-2381)

  - A denial of service vulnerability exists in the Apache     Commons FileUpload component due to improper handling of     boundaries in content-type headers when handling file     upload requests. An unauthenticated, remote attacker can     exploit this to cause processes linked against the     library to become unresponsive. (CVE-2016-3092)

  - A man-in-the-middle vulnerability exists in various     components, known as 'httpoxy', due to a failure to     properly resolve namespace conflicts in accordance with     RFC 3875 section 4.1.18. The HTTP_PROXY environment     variable is set based on untrusted user data in the     'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5385, CVE-2016-5386, CVE-2016-5387,     CVE-2016-5388)

  - A carry propagating error exists in the OpenSSL     component in the x86_64 Montgomery squaring     implementation that may cause the BN_mod_exp() function     to produce incorrect results. An unauthenticated, remote     attacker with sufficient resources can exploit this to     obtain sensitive information regarding private keys.
    Moreover, the attacker would additionally need online     access to an unpatched system using the target private     key in a scenario with persistent DH parameters and a     private key that is shared between multiple clients. For     example, this can occur by default in OpenSSL DHE based     SSL/TLS cipher suites. (CVE-2017-3732)

  - An unspecified flaw exists in the UI Framework component    that allows authenticated, remote attacker to have an    impact on integrity. (CVE-2017-10091)

An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable 'HTTP_PROXY' using the incoming 'Proxy' HTTP-request header. The environment variable 'HTTP_PROXY' is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack.

This update addresses a security issue affecting code statically linked with go :

  - CVE-2016-5386: A remote attacker could set the     HTTP_PROXY environment variable via Proxy header     (bsc#988487)

The following packages have been upgraded to a newer upstream version:
golang (1.6.3).

Security Fix(es) :

  - An input-validation flaw was discovered in the Go     programming language built in CGI implementation, which     set the environment variable 'HTTP_PROXY' using the     incoming 'Proxy' HTTP-request header. The environment     variable 'HTTP_PROXY' is used by numerous web clients,     including Go's net/http package, to specify a proxy     server to use for HTTP and, in some cases, HTTPS     requests. This meant that when a CGI-based web     application ran, an attacker could specify a proxy     server which the application then used for subsequent     outgoing requests, allowing a man-in- the-middle attack.
    (CVE-2016-5386)

An update for golang is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The golang packages provide the Go programming language compiler.

The following packages have been upgraded to a newer upstream version:
golang (1.6.3). (BZ#1346331)

Security Fix(es) :

* An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable 'HTTP_PROXY' using the incoming 'Proxy' HTTP-request header.
The environment variable 'HTTP_PROXY' is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. (CVE-2016-5386)

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1538 advisory.

    - Resolves: rhbz#1358278 - CVE-2016-5386

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-5386 AKA https://httpoxy.org/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The web application running on the remote web server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated.

ID	Name	Product	Family	Severity
101837	Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)	Nessus	Misc.	critical
93009	Amazon Linux AMI : golang (ALAS-2016-731) (httpoxy)	Nessus	Amazon Linux Local Security Checks	high
92933	openSUSE Security Update : go (openSUSE-2016-979) (httpoxy)	Nessus	SuSE Local Security Checks	high
92722	Scientific Linux Security Update : golang on SL7.x x86_64 (20160803) (httpoxy)	Nessus	Scientific Linux Local Security Checks	high
92693	RHEL 7 : golang (RHSA-2016:1538) (httpoxy)	Nessus	Red Hat Local Security Checks	critical
92687	Oracle Linux 7 : golang (ELSA-2016-1538)	Nessus	Oracle Linux Local Security Checks	high
92680	CentOS 7 : golang (CESA-2016:1538) (httpoxy)	Nessus	CentOS Local Security Checks	critical
92622	Fedora 24 : golang (2016-ea5e284d34) (httpoxy)	Nessus	Fedora Local Security Checks	high
92615	Fedora 23 : golang (2016-340e361b90) (httpoxy)	Nessus	Fedora Local Security Checks	high
92539	HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)	Nessus	Web Servers	high

Detections

Analytics

CVE-2016-5386

high

Tenable Plugins

critical

high

high

high

critical

high

critical

high

high

high