PT-2004-2306 · Qnx · Qnx Rtp

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1391

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: QNX RTP version 6.1

Description: The issue concerns an untrusted execution path vulnerability in the PPPoE daemon, allowing local users to execute arbitrary programs. This is achieved by modifying the PATH environment variable to point to a malicious mount program.

Recommendations: For QNX RTP version 6.1, consider restricting modifications to the PATH environment variable to prevent pointing to malicious mount programs until a fix is available. As a temporary workaround, restrict access to the PPPoE daemon to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-1391

Produtos afetados

Qnx Rtp

Referências · 7

• 🔥 http://securityfocus.com/bid/11105 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html · Exploit
• http://kb.cert.org/vuls/id/577566 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1391 · Nota de Segurança
• http://osvdb.org/9661 · Nota
• http://rfdslabs.com.br/qnx-advs-01-2004.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17284 · Nota