CVE-2016-4694

Critical

Published: 25/09/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 does not protect applications from untrusted CGI client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request.

Risk Assessment

Organizations may be exposed to attacks that allow HTTP traffic to be redirected to unauthorized proxy servers, potentially leading to data leakage or interception of communications.

Recommendation

It is recommended to update the system to the latest version to mitigate this vulnerability and to monitor network traffic for potential attack attempts.

Original NVD description (English source)

The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.