Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability

Bugtraq ID:	36091
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-2855
Remote:	Yes
Local:	No
Published:	Aug 20 2009 12:00AM
Updated:	Oct 26 2011 10:02PM
Credit:	Matt Benjamin
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Server 11 x64 Turbolinux Turbolinux Server 11 Turbolinux Turbolinux Server 10.0.0 x64 Turbolinux Appliance Server 3.0 x64 Turbolinux Appliance Server 3.0 Turbolinux Appliance Server 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 Squid Web Proxy Cache 3.1 .5 Squid Web Proxy Cache 3.1 .4 Squid Web Proxy Cache 3.0 PRE3 Squid Web Proxy Cache 3.0 PRE2 Squid Web Proxy Cache 3.0 PRE1 Squid Web Proxy Cache 3.0 Squid Web Proxy Cache 3.1.0.12 Squid Web Proxy Cache 3.1.0.11 Squid Web Proxy Cache 3.1 Squid Web Proxy Cache 3.0.STABLE7 Squid Web Proxy Cache 3.0.STABLE6 Squid Web Proxy Cache 3.0.STABLE5 Squid Web Proxy Cache 3.0.STABLE4 Squid Web Proxy Cache 3.0.STABLE3 Squid Web Proxy Cache 3.0.STABLE2 Squid Web Proxy Cache 3.0.STABLE17 Squid Web Proxy Cache 3.0.STABLE16 Squid Web Proxy Cache 3.0.STABLE13 Squid Web Proxy Cache 3.0.STABLE12 Squid Web Proxy Cache 3.0.STABLE1 Squid Web Proxy Cache 2.7.STABLE6 Squid Web Proxy Cache 2.7.STABLE5 Squid Web Proxy Cache 2.7 Squid Web Proxy Cache 2.6.STABLE7 Squid Web Proxy Cache 2.6.STABLE6 Squid Web Proxy Cache 2.6.STABLE5 Squid Web Proxy Cache 2.6.STABLE4 Squid Web Proxy Cache 2.6.STABLE3 Squid Web Proxy Cache 2.6.STABLE2 Squid Web Proxy Cache 2.6.STABLE18 Squid Web Proxy Cache 2.6.STABLE17 Squid Web Proxy Cache 2.6.STABLE16 Squid Web Proxy Cache 2.6.STABLE15 Squid Web Proxy Cache 2.6.STABLE14 Squid Web Proxy Cache 2.6.STABLE13 Squid Web Proxy Cache 2.6.STABLE12 Squid Web Proxy Cache 2.6.STABLE1 Squid Web Proxy Cache 2.6 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux 5 Server Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability

Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to properly parse certain external authentication headers that contain comma delimiters.

Successfully exploiting this issue allows remote attackers to trigger an infinite loop and consume system resources, denying further service to legitimate users.

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability

An attacker may exploit this issue by using readily available networking tools.

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian squid-cgi_2.7.STABLE3-4.1lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STA BLE3-4.1lenny1_ia64.deb


• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid_2.7.STABLE3-4.1lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3 -4.1lenny1_ia64.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_ia64.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_ia64.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_ia64.deb

Debian Linux 5.0 alpha

• Debian squid-cgi_2.7.STABLE3-4.1lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STA BLE3-4.1lenny1_alpha.deb


• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid_2.7.STABLE3-4.1lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3 -4.1lenny1_alpha.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_alpha.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_alpha.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_alpha.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_alpha.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva squid-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva squid-2.6.STABLE16-1.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva squid-cachemgr-2.6.STABLE16-1.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_mipsel.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_mipsel.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_mipsel.deb

Debian Linux 4.0 amd64

• Debian squid-cgi_2.6.5-6etch5_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6 etch5_amd64.deb


• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid_2.6.5-6etch5_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch 5_amd64.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb


• Debian squidclient_2.6.5-6etch5_amd64.deb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5 -6etch5_amd64.deb

Debian Linux 4.0 ia-32

• Debian squid-cgi_2.6.5-6etch5_i386.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6 etch5_i386.deb


• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid_2.6.5-6etch5_i386.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch 5_i386.deb


• Debian squid3-cgi_3.0.PRE5-5+etch2_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch2_i386.deb


• Debian squid3-client_3.0.PRE5-5+etch2_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch2_i386.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb


• Debian squid3_3.0.PRE5-5+etch2_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch2_i386.deb


• Debian squidclient_2.6.5-6etch5_i386.deb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5 -6etch5_i386.deb

Debian Linux 4.0 hppa

• Debian squid-cgi_2.6.5-6etch5_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6 etch5_hppa.deb


• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid_2.6.5-6etch5_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch 5_hppa.deb


• Debian squid3-cgi_3.0.PRE5-5+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch2_hppa.deb


• Debian squid3-client_3.0.PRE5-5+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch2_hppa.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb


• Debian squid3_3.0.PRE5-5+etch2_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch2_hppa.deb


• Debian squidclient_2.6.5-6etch5_hppa.deb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5 -6etch5_hppa.deb

Turbolinux Turbolinux Server 10.0.0 x64

• Turbolinux squid-2.5.STABLE10-9.x86_64.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/upd ates/RPMS/squid-2.5.STABLE10-9.x86_64.rpm


• Turbolinux squid-debug-2.5.STABLE10-9.x86_64.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/upd ates/RPMS/squid-debug-2.5.STABLE10-9.x86_64.rpm

Debian Linux 4.0 armel

• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb

Debian Linux 5.0 armel

• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_armel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_armel.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_armel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_armel.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_armel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_armel.deb

Debian Linux 5.0

• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb

Debian Linux 4.0 mipsel

• Debian squid-cgi_2.6.5-6etch5_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6 etch5_mipsel.deb


• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid_2.6.5-6etch5_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch 5_mipsel.deb


• Debian squid3-cgi_3.0.PRE5-5+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch2_mipsel.deb


• Debian squid3-client_3.0.PRE5-5+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch2_mipsel.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb


• Debian squid3_3.0.PRE5-5+etch2_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch2_mipsel.deb


• Debian squidclient_2.6.5-6etch5_mipsel.deb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5 -6etch5_mipsel.deb

Debian Linux 5.0 mips

• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb

Debian Linux 4.0 ia-64

• Debian squid-cgi_2.6.5-6etch5_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6 etch5_ia64.deb


• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid_2.6.5-6etch5_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch 5_ia64.deb


• Debian squid3-cgi_3.0.PRE5-5+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.P RE5-5+etch2_ia64.deb


• Debian squid3-client_3.0.PRE5-5+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3. 0.PRE5-5+etch2_ia64.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb


• Debian squid3_3.0.PRE5-5+etch2_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5- 5+etch2_ia64.deb


• Debian squidclient_2.6.5-6etch5_ia64.deb
  http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5 -6etch5_ia64.deb

Debian Linux 4.0 mips

• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb

Debian Linux 5.0 sparc

• Debian squid-cgi_2.7.STABLE3-4.1lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STA BLE3-4.1lenny1_sparc.deb


• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid_2.7.STABLE3-4.1lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3 -4.1lenny1_sparc.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_sparc.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_sparc.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_sparc.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_sparc.deb

Debian Linux 4.0 arm

• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb

Debian Linux 4.0 powerpc

• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb

Debian Linux 4.0 m68k

• Debian squid-common_2.6.5-6etch5_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6. 5-6etch5_all.deb


• Debian squid3-common_3.0.PRE5-5+etch2_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.PRE5-5+etch2_all.deb

Debian Linux 5.0 ia-32

• Debian squid-cgi_2.7.STABLE3-4.1lenny1_i386.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.7.STA BLE3-4.1lenny1_i386.deb


• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid_2.7.STABLE3-4.1lenny1_i386.deb
  http://security.debian.org/pool/updates/main/s/squid/squid_2.7.STABLE3 -4.1lenny1_i386.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_i386.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_i386.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_i386.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_i386.deb

Debian Linux 5.0 s/390

• Debian squid-common_2.7.STABLE3-4.1lenny1_all.deb
  http://security.debian.org/pool/updates/main/s/squid/squid-common_2.7. STABLE3-4.1lenny1_all.deb


• Debian squid3-cgi_3.0.STABLE8-3+lenny3_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.S TABLE8-3+lenny3_s390.deb


• Debian squid3-common_3.0.STABLE8-3+lenny3_all.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3. 0.STABLE8-3+lenny3_all.deb


• Debian squid3_3.0.STABLE8-3+lenny3_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.STABL E8-3+lenny3_s390.deb


• Debian squidclient_3.0.STABLE8-3+lenny3_s390.deb
  http://security.debian.org/pool/updates/main/s/squid3/squidclient_3.0. STABLE8-3+lenny3_s390.deb

MandrakeSoft Multi Network Firewall 2.0

• Mandriva squid-2.5.STABLE9-1.10.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva squid-2.5.STABLE9-1.10.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva squid-2.5.STABLE9-1.10.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

Squid Web Proxy Cache Authentication Header Parsing Remote Denial of Service Vulnerability

References:

• Bug 518182 - (CVE-2009-2855) CVE-2009-2855 Squid DoS in external auth header p (Jan Lieskovsky)
  
• Hang in 100% CPU loop while extacting header details using a delimiter other tha (Matt Benjamin)
  
• squid - DoS in external auth header parser (Bastian Blank)
  
• Squid Web Proxy Cache Homepage (Squid)