CVE-2002-2040 - The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1

CVE-2002-2040

Summary

The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.

References

http://online.securityfocus.com/archive/1/275218
http://www.iss.net/security_center/static/9257.php
http://www.securityfocus.com/bid/4915
http://www.securityfocus.com/bid/4916

Vulnerable Configurations

cpe:2.3:a:qnx:rtos:4.25:*:*:*:*:*:*:*
cpe:2.3:a:qnx:rtos:4.25:*:*:*:*:*:*:*
cpe:2.3:a:qnx:rtos:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:qnx:rtos:6.1.0:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 05-09-2008 - 20:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	4915 4916
bugtraq	20020603 QNX
xf	qnx-rtos-phgrafx-privileges(9257)

Last major update

05-09-2008 - 20:32

Published

31-12-2002 - 05:00

Last modified

05-09-2008 - 20:32