PT-2002-3119 · Blackberry · Qnx Neutrino

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2407

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNX Neutrino realtime operating system (RTOS) version 6.2.0

Description The issue allows local users to gain privileges by modifying certain files before their permissions are changed. The files affected include /sbin/io-audio, /bin/shutdown, /sbin/fs-pkg, phshutdown, cpim, vpim, phrelaycfg, columns, othello, peg, solitaire, and vpoker. These files are modified by certain patches, including OS Update Patch A and QNX experimental patches, as well as the games pack 2.0.3.

Recommendations For QNX Neutrino realtime operating system (RTOS) version 6.2.0, apply the necessary patches to secure the permissions of the affected files, ensuring that local users cannot modify them to gain privileges. As a temporary workaround, consider restricting access to the affected files until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2002-2407

Affected Products

Qnx Neutrino

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2407 · Security Note
• http://securityfocus.com/bid/6206 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-11/0255.html · Note
• http://iss.net/security_center/static/10656.php · Note