CVE-2002-0793
MEDIUMQNX Neutrino Real-Time Operating System - Arbitrary File Overwrite via Hard Link Following
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2002-0793. PoCs published by Simon Ouellette.
AI-analyzed exploit summary This exploit leverages a vulnerability in the QNX RTOS monitor utility, which is installed setuid root by default. By using the -f command line option, a local attacker can overwrite arbitrary system files, such as /etc/passwd, leading to privilege escalation.
Description
Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.
Exploits (3)
This exploit leverages a vulnerability in the QNX RTOS monitor utility, which is installed setuid root by default. By using the -f command line option, a local attacker can overwrite arbitrary system files, such as /etc/passwd, leading to privilege escalation.
This exploit leverages a symbolic link vulnerability in the QNX RTOS 'dumper' utility to overwrite arbitrary files and gain ownership, potentially leading to privilege escalation by modifying system files like '/etc/passwd'.
This exploit leverages a command-line option in the QNX RTOS crttrap binary to disclose arbitrary file contents. The binary is installed setuid, allowing local attackers to read sensitive files like /etc/shadow.
References (9)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N