PT-2002-2760 · Qnx · Qnx Rtos

Published 2002-12-31 · Updated 2016-10-18 · CVE-2002-2039

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNX realtime operating system (RTOS) versions 4.25 through 6.1.0

Description The issue allows local users to obtain sensitive information from core dump files by sending the SIGSERV signal, which is related to an invalid memory reference, to /bin/su in the affected QNX RTOS versions.

Recommendations For QNX RTOS versions 4.25 through 6.1.0, consider restricting access to the /bin/su command until a fix is available. As a temporary workaround, avoid using the /bin/su command with signals that may cause an invalid memory reference, such as SIGSERV, until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-2039

Affected Products

Qnx Rtos

References · 5

• 🔥 https://exploit-db.com/exploits/21502 · Exploit
• 🔥 http://securityfocus.com/bid/4914 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2039 · Security Note
• http://marc.info/?l=bugtraq&m=102312549511726&w=2 · Note
• http://iss.net/security_center/static/9256.php · Note