CVE-2005-3074: SQL Injection
Published Sep 27, 2005
·Updated
SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL commands via crafted syslog messages.
Affected Software
17 affected components
rsyslog rsyslogd<=1.0.1_stable
rsyslog rsyslogd<=1.10.1_development
rsyslog rsyslogd=0.8.0_stable
rsyslog rsyslogd=0.8.1_stable
rsyslog rsyslogd=0.8.2_stable
rsyslog rsyslogd=0.8.3_stable
rsyslog rsyslogd=0.8.4_stable
rsyslog rsyslogd=0.9.0_stable
rsyslog rsyslogd=0.9.1_stable
rsyslog rsyslogd=0.9.2_stable
rsyslog rsyslogd=0.9.3_stable
rsyslog rsyslogd=0.9.4_stable
rsyslog rsyslogd=0.9.5_stable
rsyslog rsyslogd=0.9.6_stable
rsyslog rsyslogd=0.9.7_stable
rsyslog rsyslogd=0.9.8_stable
rsyslog rsyslogd=1.0.0_stable
Remediation
Patch Available
Event History
Sep 27, 2005
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-3074?
CVE-2005-3074 is considered a critical vulnerability as it allows remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2005-3074?
To fix CVE-2005-3074, you should upgrade RSyslog to version 1.0.1 or later.
3
Which versions of RSyslog are affected by CVE-2005-3074?
CVE-2005-3074 affects RSyslog versions prior to 1.0.1 and earlier development versions before 1.10.1.
4
Can CVE-2005-3074 lead to data breaches?
Yes, if exploited, CVE-2005-3074 can lead to unauthorized access and potentially result in data breaches.
5
Is it possible to exploit CVE-2005-3074 remotely?
Yes, CVE-2005-3074 can be exploited remotely through specially crafted syslog messages.