[Full-disclosure] iDefense Security Advisory 02.07.06: QNX RTOS 6.3.0 rc.local Insecure File Permissions Vulnerability

QNX RTOS 6.3.0 rc.local Insecure File Permissions Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=387 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for use...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX RTOS 6.3.0 Local Denial of Service Vulnerability

QNX RTOS 6.3.0 Local Denial of Service Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=386 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for use in embedde...

QNX Neutrino 6.2.1 - phfont Race Condition Privilege Escalation

QNX Neutrino 6.2.1 - phfont Race Condition Privilege Escalation !/bin/sh word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383 greetings and salutations from www.lort.dk kokanin@dtors 18/10/2003 $ cksum /usr/photon/bin/phfont 4123428723 30896...

QNX RTOS 6.3.0 - Insecure rc.local Permissions System Crash Privilege Escalation

QNX RTOS 6.3.0 - Insecure rc.local Permissions System Crash Privilege Escalation !/bin/sh this combines http://www.idefense.com/intelligence/vulnerabilities/display.php?id=387 and http://www.idefense.com/intelligence/vulnerabilities/display.php?id=386 into local r00t w00t t00t t00t, hugs and kiss...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS su Command Buffer Overflow

QNX Neutrino RTOS su Command Buffer Overflow iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=385 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for use in embedded system...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS crttrap Arbitrary Library Loading Vulnerability

QNX Neutrino RTOS crttrap Arbitrary Library Loading Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=379 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for u...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS libph PHOTON_PATH Buffer Overflow Vulnerability

QNX Neutrino RTOS libph PHOTONPATH Buffer Overflow Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=382 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for us...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS fontsleuth Command Format String Vulnerability

QNX Neutrino RTOS fontsleuth Command Format String Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=380 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for us...

Multiple QNX Neutrino real-time OS vulnerabilities

libph buffer overflow. phfont race conditions. phgrafx buffer overflow. su buffer overflow. Local DoS. rc.local is world writable. passwd buffer overflow. crttrap relative libraries path. fontsleuth format string bug. libAp buffer overflow...

QNX RTOS 6.3.0 Insecure rc.local Permissions Plus System Crash Exploit

Exploit for QNX platform in category local exploits ====================================================================== QNX RTOS 6.3.0 Insecure rc.local Permissions Plus System Crash Exploit ====================================================================== !/bin/sh this combines...

[Full-disclosure] iDefense Security Advisory 02.07.06: QNX Neutrino RTOS libAp ABLPATH Buffer Overflow Vulnerability

QNX Neutrino RTOS libAp ABLPATH Buffer Overflow Vulnerability iDefense Security Advisory 02.07.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=381 February 7, 2006 I. BACKGROUND QNX Software Systems Ltd.'s Neutrino RTOS QNX is a real-time operating system designed for use i...

QNX Neutrino 6.2.1 - 'phfont' Race Condition Privilege Escalation

!/bin/sh word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383 greetings and salutations from www.lort.dk kokanin@dtors 18/10/2003 $ cksum /usr/photon/bin/phfont 4123428723 30896 /usr/photon/bin/phfont $ uname -a QNX localhost 6.2.1 2003/01/08-14:50:46est x86pc...

QNX 6.26.3 - Multiple Privilege Escalation Denial of Service Vulnerabilities

QNX 6.26.3 - Multiple Privilege Escalation Denial of Service Vulnerabilities source: https://www.securityfocus.com/bid/16539/info QNX is susceptible to multiple local vulnerabilities. These issues include multiple buffer-overflow vulnerabilities, a format-string vulnerability, an insecure...

QNX 6.2/6.3 - Multiple Privilege Escalation / Denial of Service Vulnerabilities

source: https://www.securityfocus.com/bid/16539/info QNX is susceptible to multiple local vulnerabilities. These issues include multiple buffer-overflow vulnerabilities, a format-string vulnerability, an insecure library-path vulnerability, insecure default-directory-permission vulnerability, and...

CVE-2005-1528

Untrusted search path vulnerability in the crttrap command in QNX Neutrino RTOS 6.2.1 allows local users to load arbitrary libraries via a LDLIBRARYPATH environment variable that references a malicious library...

CVE-2005-4082

Consolidated details for CVE-2005-4082 show: the dhcp.client program on QNX 4.25 vmware is setuid, reportedly by default, enabling local users to modify NIC configuration and potentially carry out additional attacks. This denotes a local-privilege issue stemming from a setuid binary. The availabl...

CVE-2005-4082

The dhcp.client program for QNX 4.25 vmware is setuid, possibly by default, which allows local users to modify the NIC configuration and conduct other attacks...

QNX 4.25 suided dhcp.client binary

Hello all, I recently got a QNX 4.25 vmware image and i found that the dhcp.client shipped with it is suided. This obviously enables a normal user to control the NIC's configuration and produce some other attacks eg: if the system has some services which depend on 'host/ip based' authentication...

QNX dhcp client privilege escalation

dhcp.client binary is suid, allowing TCP/IP settings manipulation...

possible privilege escalation on QNX Neutrino 6.3.0

a buffer overflow vulnerability in the utility "phgrafx" included in the QNX Neutrino Realtime Operating System can potentially be exploited by malicious users to escalate their privileges by default the application is suid and owned by root. example: qnx$ uname -a; id QNX qnx 6.3.0...