CVE-2014-2534: Medium severity BlackBerry QNX Neutrino RTOS vulnerability
Published Mar 18, 2014
·Updated
/sbin/pppoectl in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to obtain sensitive information by reading "bad parameter" lines in error messages, as demonstrated by reading the root password hash in /etc/shadow.
Affected Software
3 affected components
BlackBerry QNX Neutrino RTOS=6.4.1
BlackBerry QNX Neutrino RTOS=6.5.0
BlackBerry QNX Neutrino RTOS=6.5.0-sp1
Event History
Mar 18, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·05:18 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2534?
CVE-2014-2534 is considered a medium severity vulnerability due to the potential exposure of sensitive information.
2
How do I fix CVE-2014-2534?
To fix CVE-2014-2534, it is recommended to upgrade to a non-vulnerable version of BlackBerry QNX Neutrino RTOS.
3
What impact does CVE-2014-2534 have on BlackBerry QNX Neutrino RTOS?
CVE-2014-2534 allows local users to read sensitive data, such as the root password hash, from error messages.
4
Which versions of BlackBerry QNX Neutrino RTOS are affected by CVE-2014-2534?
CVE-2014-2534 affects BlackBerry QNX Neutrino RTOS versions 6.4.1, 6.5.0, and 6.5.0-sp1.
5
Can CVE-2014-2534 be exploited remotely?
No, CVE-2014-2534 requires local access to exploit the vulnerability.