PT-2002-2761 · Blackberry · Qnx

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2040

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNX realtime operating system (RTOS) versions 4.25 and 6.1.0

Description The issue concerns the phrafx and phgrafx-startup programs in the QNX realtime operating system (RTOS), which do not properly drop privileges before executing the system command. This allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.

Recommendations For QNX realtime operating system (RTOS) version 4.25, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For QNX realtime operating system (RTOS) version 6.1.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-2040

Produtos afetados

Qnx

Referências · 7

• 🔥 http://securityfocus.com/bid/4915 · Exploit
• 🔥 http://securityfocus.com/bid/4916 · Exploit
• 🔥 https://exploit-db.com/exploits/21504 · Exploit
• 🔥 https://exploit-db.com/exploits/21503 · Exploit
• http://online.securityfocus.com/archive/1/275218 · Nota
• http://iss.net/security_center/static/9257.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2040 · Nota de Segurança