CVE-2009-2855

Published: Aug 18, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

Affected (3)

Products: Squid Cache: Squid

Squid Cache

1 product

Squid

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Squid Cache Squid	Version 2.7
Squid Cache Squid	Version 2.7 stable3
Squid Cache Squid	Version 2.7 stable4

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (24)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31%3Bfilename=diff%3Batt=1%3Bbug=534982

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/07/20/10

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/08/03/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/08/04/6

Source: cve@mitre.org

http://www.securityfocus.com/bid/36091

Source: cve@mitre.org

http://www.securitytracker.com/id?1022757

Source: cve@mitre.org

http://www.squid-cache.org/bugs/show_bug.cgi?id=2541

Source: cve@mitre.org

http://www.squid-cache.org/bugs/show_bug.cgi?id=2704

Source: cve@mitre.org

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=518182

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/52610

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10592

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982