CVE		CVE-2009-2855
Status		Candidate
Description		The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
Severity		Medium
CVSS score		5
CVSS vector		(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Phase		Assigned (21.08.2010)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2855
References		BID : 36091
		CONFIRM : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=5...
		CONFIRM : http://www.squid-cache.org/bugs/show_bug.cgi?id=2541
		CONFIRM : https://bugzilla.redhat.com/show_bug.cgi?id=518182
		MISC : http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=3...
		MISC : http://www.squid-cache.org/bugs/show_bug.cgi?id=2704
		MLIST : [oss-security] 20090720 squid DoS in external auth header parser
		MLIST : [oss-security] 20090803 Re: squid DoS in external auth header parser
		MLIST : [oss-security] 20090804 Re: squid DoS in external auth header parser
		XF : squid-strlistgetitem-dos(52610)
SecurityVulns:		squid proxy DoS
		squid proxy server DoS