Title: QNX CRTTrap Local Insecure file Creation Vulnerability
Severity: HIGH
Description:
QNX is a real-time operating system available both freely and for commercial use. It is distributed and maintained by QNX Software Systems Limited. crttrap is a utility that is used to detect video hardware and launch drivers for the hardware.
A local insecure file creation vulnerability reportedly affects QNX crttrap. This issue is due to a failure of the application to properly handle permissions on affected software.
The problem presents itself when an attacker creates a file using the '-c' argument specifying the name of trap files. The application is typically installed with setuid privileges and it forces the creation of files into the '/etc/system/config/' directory, which is owned by the superuser; it also filters directory traversal strings to prevent users from writing outside the specified directory.
The issue arises when an attacker uses the '-c' argument to create a directory inside the '/etc/system/config/' directory. Apparently any directories created in this way will be accessible to the attacker's group, allowing the attacker to write to the directory.
The attacker may then write malicious symbolic-link files into the attacker-created directory, allowing the attacker to corrupt arbitrary files on the affected computer. This may facilitate destruction of sensitive files producing a system-wide denial of service condition. This issue may also be exploited to read arbitrary files on the affected computer, other attacks may be possible as well.
A similar attack can be carried out using the 'trap' argument.
Affected Products:
- QNX RTOS 6.2.0.0
- QNX RTOS 6.2.0.0 Update Patch A
References:
- QNX Software Systems Ltd.: QNX Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
