20020531 Multiple vulnerabilities in QNXmailing list
http://archives.neohapsis.com/archives/bugtraq/2002-05/0292.html CVE-2002-0793
MEDIUM
QNX RTOS 4.25 - 'CRTTrap' File Disclosure
Record summary
CVE-2002-0793 has a selected CVSS score of 5.5 (medium); EIP currently links 3 catalogued exploits.
Description
Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 3
Proofs of concept
3Catalogued exploits
ExploitDBQNX RTOS 4.25 - 'CRTTrap' File DisclosureExploitDB exploitby Simon OuelletteNot analyzed1 file
ExploitDBQNX RTOS 4.25 - monitor Arbitrary File ModificationExploitDB exploitby Simon OuelletteNot analyzed1 file
ExploitDBQNX RTOS 4.25 - dumper Arbitrary File ModificationExploitDB exploitby Simon OuelletteNot analyzed1 file
References
10qnx-rtos-monitor-f(9231)vdb entry
http://www.iss.net/security_center/static/9231.php 4901vdb entry
http://www.securityfocus.com/bid/4901 4902vdb entry
http://www.securityfocus.com/bid/4902 4903vdb entry
http://www.securityfocus.com/bid/4903 4904vdb entry
http://www.securityfocus.com/bid/4904 qnx-rtos-crttrap-c(9232)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/9232 qnx-rtos-watcom-sample(9233)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/9233 qnx-rtos-dumper-symlink(9234)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/9234 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2002-0793