PT-2004-2305 · Qnx · Qnx Rtp

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1390

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: QNX RTP version 6.1

Description: The issue is related to multiple buffer overflows in the PPPoE daemon. These overflows can be triggered by a long argument to various flags, including the -F flag, name, en, upscript, downscript, retries, timeout, scriptdetach, noscript, nodetach, remote mac, or local mac flags, allowing remote attackers to execute arbitrary code.

Recommendations: For QNX RTP version 6.1, consider disabling the PPPoE daemon until a patch is available to prevent potential exploitation. Restrict access to the flags that can trigger the buffer overflows to minimize the risk of arbitrary code execution.

Exploit

Fix

Related Identifiers

CVE-2004-1390

Affected Products

Qnx Rtp

References · 6

• 🔥 http://securityfocus.com/bid/11104 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1390 · Security Note
• http://kb.cert.org/vuls/id/961686 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17280 · Note
• http://rfdslabs.com.br/qnx-advs-01-2004.txt · Note