PT-2004-2589 · Qnx · Qnx Rtp

Julio Cesar Fort · Published 2004-09-13 · Updated 2017-07-11 · CVE-2004-1683

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QNX RTP version 6.1

Description A race condition issue exists, allowing local users to gain privileges. This is achieved by modifying the PATH environment variable to reference a malicious io-graphics program before it is executed by crrtrap.

Recommendations For QNX RTP version 6.1, consider restricting modifications to the PATH environment variable to prevent malicious references to io-graphics programs until a fix is available. As a temporary workaround, monitor and control the execution of crrtrap to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1683

Affected Products

Qnx Rtp

References · 4

• http://securityfocus.com/bid/11165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1683 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17345 · Note
• http://marc.info/?l=bugtraq&m=109511737504357&w=2 · Note