A vulnerability has been reported in RSyslog, which can be exploited by malicious people to conduct SQL injection attacks, and potentially to compromise a vulnerable system.

The vulnerability is caused due to an error in the sanitisation of received a syslog message before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code via a specially crafted syslog message.

The vulnerability has been reported in stable versions prior to 1.0.1, and in development versions prior to 1.10.1.

Solution
Update to the fixed versions.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.rsyslog.com/Article35.phtml

Deep Links
Links available to Secunia VIM customers