Signature Detail

HTTP: Squid strListGetItem Denial of Service

This signature detects attempts to exploit a known vulnerability against Squid Proxy. A successful attack can result in a denial-of-service condition.

Extended Description

Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to properly parse certain external authentication headers that contain comma delimiters. Successfully exploiting this issue allows remote attackers to trigger an infinite loop and consume system resources, denying further service to legitimate users.

Affected Products

• Debian linux 4.0
• Debian linux 4.0 Alpha
• Debian linux 4.0 Amd64
• Debian linux 4.0 Arm
• Debian linux 4.0 Armel
• Debian linux 4.0 Hppa
• Debian linux 4.0 Ia-32
• Debian linux 4.0 Ia-64
• Debian linux 4.0 M68k
• Debian linux 4.0 Mips
• Debian linux 4.0 Mipsel
• Debian linux 4.0 Powerpc
• Debian linux 4.0 S/390
• Debian linux 4.0 Sparc
• Debian linux 5.0
• Debian linux 5.0 Alpha
• Debian linux 5.0 Amd64
• Debian linux 5.0 Arm
• Debian linux 5.0 Armel
• Debian linux 5.0 Hppa
• Debian linux 5.0 Ia-32
• Debian linux 5.0 Ia-64
• Debian linux 5.0 M68k
• Debian linux 5.0 Mips
• Debian linux 5.0 Mipsel
• Debian linux 5.0 Powerpc
• Debian linux 5.0 S/390
• Debian linux 5.0 Sparc
• Gentoo linux
• Mandriva corporate_server 3.0.0
• Mandriva corporate_server 3.0.0 X86 64
• Mandriva corporate_server 4.0
• Mandriva corporate_server 4.0.0 X86 64
• Mandriva linux_mandrake 2008.0
• Mandriva linux_mandrake 2008.0 X86 64
• Mandriva multi_network_firewall 2.0.0
• Red_hat enterprise_linux 5 Server
• Red_hat enterprise_linux_desktop_workstation 5 Client
• Squid web_proxy_cache 2.6
• Squid web_proxy_cache 2.6.STABLE1
• Squid web_proxy_cache 2.6.STABLE12
• Squid web_proxy_cache 2.6.STABLE13
• Squid web_proxy_cache 2.6.STABLE14
• Squid web_proxy_cache 2.6.STABLE15
• Squid web_proxy_cache 2.6.STABLE16
• Squid web_proxy_cache 2.6.STABLE17
• Squid web_proxy_cache 2.6.STABLE18
• Squid web_proxy_cache 2.6.STABLE2
• Squid web_proxy_cache 2.6.STABLE3
• Squid web_proxy_cache 2.6.STABLE4
• Squid web_proxy_cache 2.6.STABLE5
• Squid web_proxy_cache 2.6.STABLE6
• Squid web_proxy_cache 2.6.STABLE7
• Squid web_proxy_cache 2.7
• Squid web_proxy_cache 2.7.STABLE5
• Squid web_proxy_cache 2.7.STABLE6
• Squid web_proxy_cache 3.0.0
• Squid web_proxy_cache 3.0.0 PRE1
• Squid web_proxy_cache 3.0.0 PRE2
• Squid web_proxy_cache 3.0.0 PRE3
• Squid web_proxy_cache 3.0.STABLE1
• Squid web_proxy_cache 3.0.STABLE12
• Squid web_proxy_cache 3.0.STABLE13
• Squid web_proxy_cache 3.0.STABLE16
• Squid web_proxy_cache 3.0.STABLE17
• Squid web_proxy_cache 3.0.STABLE2
• Squid web_proxy_cache 3.0.STABLE3
• Squid web_proxy_cache 3.0.STABLE4
• Squid web_proxy_cache 3.0.STABLE5
• Squid web_proxy_cache 3.0.STABLE6
• Squid web_proxy_cache 3.0.STABLE7
• Squid web_proxy_cache 3.1
• Squid web_proxy_cache 3.1.0.11
• Squid web_proxy_cache 3.1.0.12
• Squid web_proxy_cache 3.1.0.4
• Squid web_proxy_cache 3.1.0.5
• Suse opensuse 11.0
• Suse opensuse 11.1
• Suse opensuse 11.2
• Suse suse_linux_enterprise 10 SP2
• Suse suse_linux_enterprise 10 SP3
• Suse suse_linux_enterprise 11
• Suse suse_linux_enterprise_server 9
• Turbolinux appliance_server 2.0
• Turbolinux appliance_server 3.0
• Turbolinux appliance_server 3.0 X64
• Turbolinux turbolinux_server 10.0.0
• Turbolinux turbolinux_server 10.0.0 X64
• Turbolinux turbolinux_server 11
• Turbolinux turbolinux_server 11 X64
• Ubuntu ubuntu_linux 6.06 LTS Amd64
• Ubuntu ubuntu_linux 6.06 LTS I386
• Ubuntu ubuntu_linux 6.06 LTS Powerpc
• Ubuntu ubuntu_linux 6.06 LTS Sparc
• Ubuntu ubuntu_linux 8.04 LTS Amd64
• Ubuntu ubuntu_linux 8.04 LTS I386
• Ubuntu ubuntu_linux 8.04 LTS Lpia
• Ubuntu ubuntu_linux 8.04 LTS Powerpc
• Ubuntu ubuntu_linux 8.04 LTS Sparc
• Ubuntu ubuntu_linux 8.10 Amd64
• Ubuntu ubuntu_linux 8.10 I386
• Ubuntu ubuntu_linux 8.10 Lpia
• Ubuntu ubuntu_linux 8.10 Powerpc
• Ubuntu ubuntu_linux 8.10 Sparc
• Ubuntu ubuntu_linux 9.04 Amd64
• Ubuntu ubuntu_linux 9.04 I386
• Ubuntu ubuntu_linux 9.04 Lpia
• Ubuntu ubuntu_linux 9.04 Powerpc
• Ubuntu ubuntu_linux 9.04 Sparc
• Ubuntu ubuntu_linux 9.10 Amd64
• Ubuntu ubuntu_linux 9.10 I386
• Ubuntu ubuntu_linux 9.10 Lpia
• Ubuntu ubuntu_linux 9.10 Powerpc
• Ubuntu ubuntu_linux 9.10 Sparc

References

• BugTraq: 36091
• CVE: CVE-2009-2855
• URL: http://xforce.iss.net/xforce/xfdb/52610