CVE-2002-2040 Privilege escalation in n/a

High 7.2 Published 14 Jul 2005 Updated 17 Sep 2024

Local attackers can escalate privileges and execute arbitrary code in QNX RTOS by exploiting improper privilege dropping in phrafx utilities via PATH manipulation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2002-2040?

CVE-2002-2040 is a high-severity vulnerability in n/a, published on 14 Jul 2005. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.

Which versions are affected by CVE-2002-2040?

It affects 1 product.

Products include Qnx Rtos.

How do I fix CVE-2002-2040?

No fix has been published for CVE-2002-2040 yet. Limit exposure of the affected software until one is available.

Is CVE-2002-2040 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2002-2040 exists.

Public exploit code: 2 Exploit-DB entries.

Sources

Also known as GHSA-fqc4-8m96-pvh3.