CVE-2016-5387 in macOS

Summary

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Reservation

06/10/2016

Disclosure

07/18/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
108930	Apple macOS apache access control	284	Not defined	Official fix	CVE-2016-5387
103831	Oracle Enterprise Manager Ops Center Satellite access control	284	Not defined	Official fix	CVE-2016-5387
98603	Apple macOS Apache access control	284	Not defined	Official fix	CVE-2016-5387
89849	nginx RFC 3875 Namespace Conflict access control	284	Not defined	Official fix	CVE-2016-5387
89669	Apache HTTP Server RFC 3875 Namespace Conflict access control	284	Not defined	Official fix	CVE-2016-5387

Sources

• MITRE
• NVD
• CVE Details