vulnwire
7.2high

CVE-2002-12391 exploit

QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which a…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB

QNX Neutrino RTOS 6.2.0 uses the PATH environment variable to find and execute the cp program while operating at raised privileges, which allows local users to gain privileges by modifying the PATH to point to a malicious cp program.

Exploit prediction (EPSS)

0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

Exploits and detections

  • EDB-22002 QNX RTOS 6.2 - Application Packager Non-Explicit Path Execution · local · 2002-11-08

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

References

  • archives.neohapsis.com /archives/vulnwatch/2002-q4/0066.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • marc.info /?l=bugtraq&m=103679043232178&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/6146 · vdb-entry, x_refsource_BID, x_transferred
  • idefense.com /advisory/11.08.02b.txt · x_refsource_MISC, x_transferred
  • iss.net /security_center/static/10564.php · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.