CVE:CVE-2016-5387
CNNVD:CNNVD-201607-540
Apache HTTP Server是美国阿帕奇（Apache）软件基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。
Apache HTTP Server 2.4.23及之前的版本中存在安全漏洞，该漏洞源于程序没有解决RFC 3875模式下的命名空间冲突。程序没有正确处理来自HTTP_PROXY环境变量中不可信客户端数据应用程序。远程攻击者借助HTTP请求中特制的Proxy header消息利用该漏洞实施中间人攻击，指引服务器发送连接到任意主机。
solution:Upgrade apache http_server to a higher version than 2.2.31,2.4.23,and avoid the version [2.2.0,2.2.31],[2.4.1,2.4.23]; Upgrade hp system_management_homepage to a higher version than 7.5.5.0,and avoid the version (,7.5.5.0]; Upgrade oracle communications_user_data_repository to a higher version than 12.4,and avoid the version [10.0.0,12.4]; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.2.2,12.3.2,and avoid the version 12.2.2,12.3.2; Upgrade oracle linux to a higher version than 5,6,7,and avoid the version 5,6,7; Upgrade oracle solaris to a higher version than 11.3,and avoid the version 11.3; Upgrade fedoraproject fedora to a higher version than 23,24,and avoid the version 23,24; Upgrade redhat jboss_web_server to a higher version than 2.1.0,and avoid the version 2.1.0; Upgrade redhat jboss_enterprise_web_server to a higher version than 2.0.0,3.0.0,and avoid the version 2.0.0,3.0.0; Upgrade redhat jboss_core_services to a higher version than 1.0,and avoid the version 1.0; Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_eus to a higher version than 7.2,7.3,7.4,7.5,7.6,7.7,and avoid the version 7.2,7.3,7.4,7.5,7.6,7.7; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.2,7.3,7.4,7.6,7.7,and avoid the version 7.2,7.3,7.4,7.6,7.7; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.2,7.3,7.6,7.7,and avoid the version 7.2,7.3,7.6,7.7; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade debian debian_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,15.10,16.04,and avoid the version 12.04,14.04,15.10,16.04; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.2,and avoid the version 13.2