Description
Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- QNX RTOS 4.25 - 'CRTTrap' File Disclosure EDB-21499 · local · May 31, 2002 · verified
- QNX RTOS 4.25 - monitor Arbitrary File Modification EDB-21500 · local · May 31, 2002 · verified
- QNX RTOS 4.25 - dumper Arbitrary File Modification EDB-21501 · local · May 31, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 4901 vdb-entry
- 4902 vdb-entry
- 4904 vdb-entry
- 20020531 Multiple vulnerabilities in QNX mailing-list
- qnx-rtos-monitor-f(9231) vdb-entry
- qnx-rtos-dumper-symlink(9234) vdb-entry
- 4903 vdb-entry
- qnx-rtos-crttrap-c(9232) vdb-entry
- qnx-rtos-watcom-sample(9233) vdb-entry