The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2010-0221 advisory.

    - Resolves: #561828 - CVE-2009-2855 CVE-2010-0308 squid various flaws [rhel-5.5]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use (up to 100%). (CVE-2009-2855)

Note: The CVE-2009-2855 issue only affected non-default configurations that use an external ACL helper script.

A flaw was found in the way Squid handled truncated DNS replies. A remote attacker able to send specially crafted UDP packets to Squid's DNS client port could trigger an assertion failure in Squid's child process, causing that child process to exit. (CVE-2010-0308)

This update also fixes the following bugs :

  - Squid's init script returns a non-zero value when trying     to stop a stopped service. This is not LSB compliant and     can generate difficulties in cluster environments. This     update makes stopping LSB compliant. (BZ#521926)

  - Squid is not currently built to support MAC address     filtering in ACLs. This update includes support for MAC     address filtering. (BZ#496170)

  - Squid is not currently built to support Kerberos     negotiate authentication. This update enables Kerberos     authentication. (BZ#516245)

  - Squid does not include the port number as part of URIs     it constructs when configured as an accelerator. This     results in a 403 error. This update corrects this     behavior. (BZ#538738)

  - the error_map feature does not work if the same handling     is set also on the HTTP server that operates in deflate     mode. This update fixes this issue. (BZ#470843)

After installing this update, the squid service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-24 (Squid: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Squid. Please review       the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to execute arbitrary code       with the privileges of the Squid process or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The following vulnerabilities have been fixed in squid :

  - DoS via special crafted auth header CVE-2010-0308: DoS     via invalid DoS header. (CVE-2009-2855)

An updated squid package that fixes two security issues and several bugs is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

A flaw was found in the way Squid processed certain external ACL helper HTTP header fields that contained a delimiter that was not a comma. A remote attacker could issue a crafted request to the Squid server, causing excessive CPU use (up to 100%). (CVE-2009-2855)

Note: The CVE-2009-2855 issue only affected non-default configurations that use an external ACL helper script.

A flaw was found in the way Squid handled truncated DNS replies. A remote attacker able to send specially crafted UDP packets to Squid's DNS client port could trigger an assertion failure in Squid's child process, causing that child process to exit. (CVE-2010-0308)

This update also fixes the following bugs :

* Squid's init script returns a non-zero value when trying to stop a stopped service. This is not LSB compliant and can generate difficulties in cluster environments. This update makes stopping LSB compliant. (BZ#521926)

* Squid is not currently built to support MAC address filtering in ACLs. This update includes support for MAC address filtering.
(BZ#496170)

* Squid is not currently built to support Kerberos negotiate authentication. This update enables Kerberos authentication.
(BZ#516245)

* Squid does not include the port number as part of URIs it constructs when configured as an accelerator. This results in a 403 error. This update corrects this behavior. (BZ#538738)

* the error_map feature does not work if the same handling is set also on the HTTP server that operates in deflate mode. This update fixes this issue. (BZ#470843)

All users of squid should upgrade to this updated package, which resolves these issues. After installing this update, the squid service will be restarted automatically.

The following vulnerabilities have been fixed in squid :

  - DoS via special crafted auth header. (CVE-2009-2855)

  - DoS via invalid DoS header. (CVE-2010-0308)

The following vulnerabilities have been fixed in squid :

  - CVE-2009-2855: DoS via special crafted auth header

  - CVE-2010-0308: DoS via invalid DoS header

  - CVE-2009-2622: DoS in squid3 via broken HTTP handling

  - CVE-2009-2621: DoS in squid3 via not enforced 'buffer     limits and related bound checks'

Two denial of service vulnerabilities have been discovered in squid and squid3, a web proxy. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2855     Bastian Blank discovered that it is possible to cause a     denial of service via a crafted auth header with certain     comma delimiters.

  - CVE-2010-0308     Tomas Hoger discovered that it is possible to cause a     denial of service via invalid DNS header-only packets.

It was discovered that Squid incorrectly handled certain auth headers.
A remote attacker could exploit this with a specially crafted auth header and cause Squid to go into an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 8.10, 9.04 and 9.10. (CVE-2009-2855)

It was discovered that Squid incorrectly handled certain DNS packets.
A remote attacker could exploit this with a specially crafted DNS packet and cause Squid to crash, resulting in a denial of service.
(CVE-2010-0308).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of the Squid proxy caching server installed on the remote host is older than 3.0.STABLE19 / 3.1.0.14 / 2.6.STABLE23. A bug in the 'strListGetItem()' function in 'src/HttpHeaderTools.c' can result in an infinite loop when processing a specially crafted auth header with certain comma delimiters.

A remote attacker may be able to leverage this issue to cause a denial of service.

A vulnerability was discovered and corrected in squid :

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function (CVE-2009-2855).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

ID	Name	Product	Family	Severity
181029	Oracle Linux 5 : squid (ELSA-2010-0221)	Nessus	Oracle Linux Local Security Checks	high
60775	Scientific Linux Security Update : squid on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56658	GLSA-201110-24 : Squid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
49925	SuSE 10 Security Update : squid (ZYPP Patch Number 6931)	Nessus	SuSE Local Security Checks	medium
46285	RHEL 5 : squid (RHSA-2010:0221)	Nessus	Red Hat Local Security Checks	medium
45132	SuSE 10 Security Update : squid (ZYPP Patch Number 6930)	Nessus	SuSE Local Security Checks	medium
45131	SuSE 11 Security Update : squid (SAT Patch Number 2143)	Nessus	SuSE Local Security Checks	medium
45129	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45127	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45126	openSUSE Security Update : squid (squid-2144)	Nessus	SuSE Local Security Checks	medium
45125	SuSE9 Security Update : squid (YOU Patch Number 12597)	Nessus	SuSE Local Security Checks	medium
44855	Debian DSA-1991-1 : squid/squid3 - denial of service	Nessus	Debian Local Security Checks	medium
44641	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : squid vulnerabilities (USN-901-1)	Nessus	Ubuntu Local Security Checks	medium
44400	Squid < 3.0.STABLE19 / 3.1.0.14 / 2.6.STABLE23 strListGetItem Function Remote DoS	Nessus	Firewalls	medium
43852	Mandriva Linux Security Advisory : squid (MDVSA-2009:241-1)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-2855

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium