PT-2002-3121 · Blackberry · Photon Microgui+1

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2409

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNX Neutrino realtime operating system (RTOS) versions 6.1.0 through 6.2.0

Description The issue allows attackers to read user clipboard information via a direct request to the 1.TEXT file in a directory whose name is a hex-encoded user ID. This is related to the Photon microGUI component.

Recommendations For QNX Neutrino realtime operating system (RTOS) versions 6.1.0 through 6.2.0, consider restricting access to the directory containing the 1.TEXT file to prevent unauthorized reading of user clipboard information. As a temporary workaround, restrict access to the 1.TEXT file until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2002-2409

Affected Products

Photon Microgui

Qnx Neutrino

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2409 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-11/0267.html · Note
• http://securityfocus.com/bid/6207 · Note
• http://iss.net/security_center/static/10658.php · Note