CVE-2002-2407: Medium severity qnx rtos vulnerability

Published Dec 31, 2002

Updated

Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Update Patch A, (2) /bin/shutdown, (3) /sbin/fs-pkg, and (4) phshutdown by QNX experimental patches, (5) cpim, (6) vpim, (7) phrelaycfg, and (8) columns, (9) othello, (10) peg, (11) solitaire, and (12) vpoker in the games pack 2.0.3, which allows local users to gain privileges by modifying the files before permissions are changed.

Affected Software

2 affected components

QNX RTOS=6.2

QNX RTOS=6.2a

Event History

Dec 31, 2002

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityWeaknessAffected Software

Nov 1, 2007

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2002-2407?

CVE-2002-2407 is classified as a critical vulnerability due to insecure permissions in key system files.

How do I fix CVE-2002-2407?

To fix CVE-2002-2407, ensure that the permissions on the affected files are set securely.

Which QNX RTOS versions are affected by CVE-2002-2407?

CVE-2002-2407 affects QNX RTOS versions 6.2 and 6.2a.

What files are impacted by CVE-2002-2407?

CVE-2002-2407 impacts files including /sbin/io-audio, /bin/shutdown, and /sbin/fs-pkg.

Who reported the vulnerability CVE-2002-2407?

CVE-2002-2407 was reported by security researchers through the Bugtraq mailing list.