CVE-2016-3875
published 2016-09-11CVE-2016-3875: server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_SAFE_BOOT setting, which allows physically proximate…
PriorityP427medium6.8CVSS 3.0
AVPACLPRNUINSUCHIHAH
EPSS
0.20%
9.8th percentile
server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_SAFE_BOOT setting, which allows physically proximate attackers to bypass intended access restrictions and boot to safe mode via unspecified vectors, aka internal bug 26251884.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| msrc | azl3_golang_1.23.7-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_golang_1.23.9-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_golang_1.24.3-1_on_azure_linux_3.0 | — | — |
| twisted | twisted | >= 0 < 16.3.1 | 16.3.1 |
CVSS provenance
nvdv3.06.8MEDIUMCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
ghsa8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6pw5-q6cj-fvfc: server/wm/WindowManagerService
ghsa_unreviewed·2022-05-17
CVE-2016-3875 [HIGH] GHSA-6pw5-q6cj-fvfc: server/wm/WindowManagerService
server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_SAFE_BOOT setting, which allows physically proximate attackers to bypass intended access restrictions and boot to safe mode via unspecified vectors, aka internal bug 26251884.
GHSA
Improper Access Control in Apache Tomcat
ghsa·2022-05-13·CVSS 8.1
CVE-2016-5388 [HIGH] CWE-284 Improper Access Control in Apache Tomcat
Improper Access Control in Apache Tomcat
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
GHSA
Forced Browsing in Twisted
ghsa·2021-04-30
CVE-2016-1000111 [MEDIUM] CWE-425 Forced Browsing in Twisted
Forced Browsing in Twisted
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.
Red Hat
erlang: allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy serve
vendor_redhat·2019-12-10·CVSS 6.1
CVE-2016-1000107 [MEDIUM] CWE-20 erlang: allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy serve
erlang: allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy serve
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
A flaw was found in the Inets application in Erlang version 22.1 and possibly earlier, where it follows RFC 3875 section 4.1.18 and does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable. This flaw allows remote attackers to redirect an applica
Android
CVE-2016-3875: Android Security Bulletin 2016-09-01
CVE: CVE-2016-3875
Severity: HIGH
Affected AOSP versions: 6
vendor_android·2016-09-01·CVSS 6.8
CVE-2016-3875 [MEDIUM] CVE-2016-3875: Android Security Bulletin 2016-09-01
CVE: CVE-2016-3875
Severity: HIGH
Affected AOSP versions: 6
Android Security Bulletin 2016-09-01
CVE: CVE-2016-3875
Severity: HIGH
Affected AOSP versions: 6.0, 6.0.1
References: A-26251884
Red Hat
Twisted: sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 5.3
CVE-2016-1000111 [MEDIUM] CWE-20 Twisted: sets environmental variable based on user supplied Proxy request header
Twisted: sets environmental variable based on user supplied Proxy request header
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attack
Red Hat
HTTPD: sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5387 [HIGH] CWE-20 HTTPD: sets environmental variable based on user supplied Proxy request header
HTTPD: sets environmental variable based on user supplied Proxy request header
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by
Red Hat
Tomcat: CGI sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5388 [HIGH] CWE-20 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
Tomcat: CGI sets environmental variable based on user supplied Proxy request header
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY en
Red Hat
PHP: sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5385 [HIGH] CWE-20 PHP: sets environmental variable based on user supplied Proxy request header
PHP: sets environmental variable based on user supplied Proxy request header
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attac
Red Hat
Go: sets environmental variable based on user supplied Proxy request header
vendor_redhat·2016-07-18·CVSS 8.1
CVE-2016-5386 [HIGH] CWE-20 Go: sets environmental variable based on user supplied Proxy request header
Go: sets environmental variable based on user supplied Proxy request header
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable "HTTP_PROXY" using the incoming "Proxy" HTTP-request header. The environment variable "HTTP_PROXY" is used by numerous web clients, including Go's net/http
Microsoft
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client dat
vendor_msrc·2016-07-12·CVSS 8.1
CVE-2016-5386 [HIGH] CWE-284 The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client dat
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro i
No detection rules found.
No public exploits indexed.
http://source.android.com/security/bulletin/2016-09-01.htmlhttp://www.securityfocus.com/bid/92818http://www.securitytracker.com/id/1036763https://android.googlesource.com/platform/frameworks/base/+/69729fa8b13cadbf3173fe1f389fe4f3b7bd0f9chttp://source.android.com/security/bulletin/2016-09-01.htmlhttp://www.securityfocus.com/bid/92818http://www.securitytracker.com/id/1036763https://android.googlesource.com/platform/frameworks/base/+/69729fa8b13cadbf3173fe1f389fe4f3b7bd0f9c
2016-09-11
Published