A vulnerability has been reported in syslog-ng, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to the improper processing of incoming timestamps. This can be exploited to trigger a NULL pointer dereference via a specially crafted message containing a timestamp without a terminating space character.

The vulnerability is reported in syslog-ng versions prior to 2.0.6 and syslog-ng Premium Edition versions prior to 2.1.8.

Solution
Update to syslog-ng 2.0.6 or syslog-ng Premium Edition 2.1.8.
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Oriol Carreras.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://seclists.org/bugtraq/2007/Dec/0202.html

Deep Links
Links available to Secunia VIM customers