PT-2002-3119 · Blackberry · Qnx Neutrino

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2407

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNX Neutrino realtime operating system (RTOS) version 6.2.0

Description The issue allows local users to gain privileges by modifying certain files before their permissions are changed. The files affected include /sbin/io-audio, /bin/shutdown, /sbin/fs-pkg, phshutdown, cpim, vpim, phrelaycfg, columns, othello, peg, solitaire, and vpoker. These files are modified by certain patches, including OS Update Patch A and QNX experimental patches, as well as the games pack 2.0.3.

Recommendations For QNX Neutrino realtime operating system (RTOS) version 6.2.0, apply the necessary patches to secure the permissions of the affected files, ensuring that local users cannot modify them to gain privileges. As a temporary workaround, consider restricting access to the affected files until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2002-2407

Produtos afetados

Qnx Neutrino

Referências · 4

• http://securityfocus.com/bid/6206 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2002-11/0255.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2407 · Nota de Segurança
• http://iss.net/security_center/static/10656.php · Nota