PT-2004-2306 · Qnx · Qnx Rtp

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1391

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: QNX RTP version 6.1

Description: The issue concerns an untrusted execution path vulnerability in the PPPoE daemon, allowing local users to execute arbitrary programs. This is achieved by modifying the PATH environment variable to point to a malicious mount program.

Recommendations: For QNX RTP version 6.1, consider restricting modifications to the PATH environment variable to prevent pointing to malicious mount programs until a fix is available. As a temporary workaround, restrict access to the PPPoE daemon to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-1391

Affected Products

Qnx Rtp

References · 7

• 🔥 http://securityfocus.com/bid/11105 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0155.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1391 · Security Note
• http://kb.cert.org/vuls/id/577566 · Note
• http://osvdb.org/9661 · Note
• http://rfdslabs.com.br/qnx-advs-01-2004.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17284 · Note