CVE-2009-2855: Input Validation

A denial of service flaw was found in the way Squid used to process certain external ACL helper HTTP-Header fields (%{header:<delimiter>member}), where <delimiter> is not a comma. Remote attacker could use this flaw to cause an excessive CPU use by issuing such a request to the Squid server.

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-2855 to this vulnerability: ------------------------------------------------------------------------------

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

References: ----------- [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2855 [2] http://www.openwall.com/lists/oss-security/2009/07/20/10 [3] http://www.openwall.com/lists/oss-security/2009/08/03/3 [4] http://www.openwall.com/lists/oss-security/2009/08/04/6 [5] http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31;filename=diff;att=1;bug=534982 [6] http://www.squid-cache.org/bugs/showbug.cgi?id=2704 [7] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982

Note: The proposed patch from Debian [6] isn't the upstream one. Please wait, while upstream confirms it or comes with another one.

Upstream bug report: --------------------

http://www.squid-cache.org/bugs/showbug.cgi?id=2541