CVE-2004-1391: Medium severity QNX RTOS vulnerability

Published Dec 31, 2004

Updated

Untrusted execution path vulnerability in the PPPoE daemon (PPPoEd) in QNX RTP 6.1 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious mount program.

Affected Software

7 affected components

QNX RTOS=6.2.0

QNX RTP=6.1

QNX RTOS=6.2.1b

QNX RTOS=6.3.0

QNX RTOS=6.1.0a

QNX RTOS=6.2.1a

QNX RTOS=6.1.0

Event History

Dec 31, 2004

CVE Published

05:00 AM

Feb 6, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1391?

CVE-2004-1391 is considered a high severity vulnerability due to its potential to allow local users to execute arbitrary programs.

How do I fix CVE-2004-1391?

To fix CVE-2004-1391, users should ensure that the PATH environment variable is not modifiable by untrusted users and update to the latest version of QNX that addresses this vulnerability.

Who is affected by CVE-2004-1391?

CVE-2004-1391 affects local users of QNX RTP 6.1 and its subsequent versions.

What type of vulnerability is CVE-2004-1391?

CVE-2004-1391 is classified as an untrusted execution path vulnerability.

What can an attacker do with CVE-2004-1391?

An attacker exploiting CVE-2004-1391 can execute arbitrary programs on the system by manipulating the PATH environment variable.