PT-2004-2589 · Qnx · Qnx Rtp

Julio Cesar Fort · Publicado 2004-09-13 · Atualizado 2017-07-11 · CVE-2004-1683

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QNX RTP version 6.1

Description A race condition issue exists, allowing local users to gain privileges. This is achieved by modifying the PATH environment variable to reference a malicious io-graphics program before it is executed by crrtrap.

Recommendations For QNX RTP version 6.1, consider restricting modifications to the PATH environment variable to prevent malicious references to io-graphics programs until a fix is available. As a temporary workaround, monitor and control the execution of crrtrap to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-1683

Produtos afetados

Qnx Rtp

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/17345 · Nota
• http://marc.info/?l=bugtraq&m=109511737504357&w=2 · Nota
• http://securityfocus.com/bid/11165 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1683 · Nota de Segurança