Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-2534. PoCs published by cenobyte.
AI-analyzed exploit summary The exploit leverages a privilege escalation flaw in QNX's setuid root binary `pppoectl`, which fails to validate file permissions. By specifying `/etc/shadow` as a configuration file, the tool discloses the first line of the shadow file in its error output, exposing the root password hash.
Description
/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.
Exploits (1)
The exploit leverages a privilege escalation flaw in QNX's setuid root binary `pppoectl`, which fails to validate file permissions. By specifying `/etc/shadow` as a configuration file, the tool discloses the first line of the shadow file in its error output, exposing the root password hash.