Improper access control - CVE-2016-5386

Vulnerability identifier: #VU33632

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5386

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Fedora
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 840 9840-AE1 & 9843-AE1
go (Alpine package)
golang
golang (Red Hat package)
IBM Concert Software
IBM Cloud Pak for Business Automation
IBM Storwize V3700
IBM Storwize V5000
IBM Storwize V7000
IBM FlashSystem V9000
IBM Storwize V3500

Install update from vendor's website.

go (Alpine package) - update to 1.6.3-r0
IBM Concert Software - update to 1.0.1
golang - addressed in versions 1.5.4-2.fc23, 1.6.3-1.fc24
golang (Red Hat package) - update to 1.6.3-1.el7_2.1
IBM Storwize V3700 - addressed in versions 7.6.1.6, 7.7.0.4, 7.7.1.3
IBM Storwize V5000 - addressed in versions 7.6.1.6, 7.7.0.4, 7.7.1.3
IBM Storwize V7000 - addressed in versions 7.6.1.6, 7.7.0.4, 7.7.1.3
IBM FlashSystem V9000 - addressed in versions 7.6.1.6, 7.7.0.4, 7.7.1.3
IBM Storwize V3500 - addressed in versions 7.6.1.6, 7.7.0.4, 7.7.1.3
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1

• http://rhn.redhat.com/errata/RHSA-2016-1538.html
• http://www.kb.cert.org/vuls/id/797896
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1353798
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
• https://httpoxy.org/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJPEWB5ZNTU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZVJ3WEESJ/

• Improper access control in go (Alpine package)
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in IBM FlashSystem models 840 and 900
• Multiple vulnerabilities in SAN Volume Controller, Storwize family and FlashSystem V9000 products
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Fedora 24 update for golang
• Fedora 23 update for golang
• Red Hat Enterprise Linux 7 update for golang