漏洞类别：Amazon Linux
漏洞等级： 
漏洞信息
Package updates are available for Amazon Linux that fix the following vulnerabilities: CVE-2016-5387: It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. 1353755: CVE-2016-5387 Apache HTTPD: sets environmental variable based on user supplied Proxy request header.
漏洞危害
Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.
解决方案
Administrators are advised to apply the appropriate software updates.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
0day
文章评论