Security fix for CVE-2016-5386 AKA https://httpoxy.org/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for golang is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The golang packages provide the Go programming language compiler.

The following packages have been upgraded to a newer upstream version:
golang (1.6.3). (BZ#1346331)

Security Fix(es) :

* An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable 'HTTP_PROXY' using the incoming 'Proxy' HTTP-request header.
The environment variable 'HTTP_PROXY' is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. (CVE-2016-5386)

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable 'HTTP_PROXY' using the incoming 'Proxy' HTTP-request header. The environment variable 'HTTP_PROXY' is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack.

The following packages have been upgraded to a newer upstream version:
golang (1.6.3).

Security Fix(es) :

  - An input-validation flaw was discovered in the Go     programming language built in CGI implementation, which     set the environment variable 'HTTP_PROXY' using the     incoming 'Proxy' HTTP-request header. The environment     variable 'HTTP_PROXY' is used by numerous web clients,     including Go's net/http package, to specify a proxy     server to use for HTTP and, in some cases, HTTPS     requests. This meant that when a CGI-based web     application ran, an attacker could specify a proxy     server which the application then used for subsequent     outgoing requests, allowing a man-in- the-middle attack.
    (CVE-2016-5386)

This update addresses a security issue affecting code statically linked with go :

  - CVE-2016-5386: A remote attacker could set the     HTTP_PROXY environment variable via Proxy header     (bsc#988487)

The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Bouncy Castle Java library due to     improper validation of a point within the elliptic     curve. An unauthenticated, remote attacker can exploit     this to obtain private keys by using a series of     specially crafted elliptic curve Diffie-Hellman (ECDH)     key exchanges, also known as an 'invalid curve attack.'     (CVE-2015-7940)

  - A flaw exists in the PathTools module for Perl in the     File::Spec::canonpath() function that is triggered as     strings are returned as untainted even when passing     tainted input. An unauthenticated, remote attacker can     exploit this to pass unvalidated user input to sensitive     or insecure areas. (CVE-2015-8607)

  - An overflow condition exists in Perl in the MapPathA()     function due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-8608)

  - A remote code execution vulnerability exists in the     Apache Struts component due to improper handling of     multithreaded access to an ActionForm instance. An     unauthenticated, remote attacker can exploit this, via a     specially crafted multipart request, to execute     arbitrary code or cause a denial of service condition.
    (CVE-2016-1181)

  - A flaw exists in Perl that is triggered during the     handling of variables that appear twice in the     environment (envp), causing the last value to appear in     %ENV, while getenv would return the first. An     unauthenticated, remote attacker can exploit this to     cause variables to be incorrectly propagated to     subprocesses, regardless of the protections offered by     taint checking. (CVE-2016-2381)

  - A denial of service vulnerability exists in the Apache     Commons FileUpload component due to improper handling of     boundaries in content-type headers when handling file     upload requests. An unauthenticated, remote attacker can     exploit this to cause processes linked against the     library to become unresponsive. (CVE-2016-3092)

  - A man-in-the-middle vulnerability exists in various     components, known as 'httpoxy', due to a failure to     properly resolve namespace conflicts in accordance with     RFC 3875 section 4.1.18. The HTTP_PROXY environment     variable is set based on untrusted user data in the     'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5385, CVE-2016-5386, CVE-2016-5387,     CVE-2016-5388)

  - A carry propagating error exists in the OpenSSL     component in the x86_64 Montgomery squaring     implementation that may cause the BN_mod_exp() function     to produce incorrect results. An unauthenticated, remote     attacker with sufficient resources can exploit this to     obtain sensitive information regarding private keys.
    Moreover, the attacker would additionally need online     access to an unpatched system using the target private     key in a scenario with persistent DH parameters and a     private key that is shared between multiple clients. For     example, this can occur by default in OpenSSL DHE based     SSL/TLS cipher suites. (CVE-2017-3732)

  - An unspecified flaw exists in the UI Framework component    that allows authenticated, remote attacker to have an    impact on integrity. (CVE-2017-10091)

The web application running on the remote web server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1538 advisory.

    - Resolves: rhbz#1358278 - CVE-2016-5386

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
92615	Fedora 23 : golang (2016-340e361b90) (httpoxy)	Nessus	Fedora Local Security Checks	7/29/2016	1/11/2021	high
92693	RHEL 7 : golang (RHSA-2016:1538) (httpoxy)	Nessus	Red Hat Local Security Checks	8/3/2016	10/24/2019	critical
93009	Amazon Linux AMI : golang (ALAS-2016-731) (httpoxy)	Nessus	Amazon Linux Local Security Checks	8/18/2016	4/18/2018	high
92722	Scientific Linux Security Update : golang on SL7.x x86_64 (20160803) (httpoxy)	Nessus	Scientific Linux Local Security Checks	8/4/2016	1/14/2021	high
92933	openSUSE Security Update : go (openSUSE-2016-979) (httpoxy)	Nessus	SuSE Local Security Checks	8/12/2016	1/19/2021	high
101837	Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)	Nessus	Misc.	7/20/2017	4/11/2022	critical
92539	HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)	Nessus	Web Servers	7/25/2016	4/11/2022	high
92687	Oracle Linux 7 : golang (ELSA-2016-1538)	Nessus	Oracle Linux Local Security Checks	8/3/2016	10/22/2024	high
92622	Fedora 24 : golang (2016-ea5e284d34) (httpoxy)	Nessus	Fedora Local Security Checks	7/29/2016	1/11/2021	high
92680	CentOS 7 : golang (CESA-2016:1538) (httpoxy)	Nessus	CentOS Local Security Checks	8/3/2016	1/4/2021	critical

Detections

Analytics

Plugins Search

high

critical

high

high

high

critical

high

high

high

critical