Back to Database
Status published
Low
CVE-2011-4060
The runtime linker in QNX Neutrino RTOS 6.5.0 before Service...
Vulnerability Description
The runtime linker in QNX Neutrino RTOS 6.5.0 before Service Pack 1 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environment variables when a program is spawned from a setuid program, which allows local users to overwrite files via a symlink attack.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-4060
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/archive/1/518659
- http://www.qnx.com/developers/docs/6.5.0_sp1/index.jsp?topic=%2Fcom.qnx.doc.momentics_release_notes%2Frel_6.5.0_SP1.html
- http://www.nth-dimension.org.uk/pub/NDSA20110310.txt.asc
- http://www.osvdb.org/71784
- http://www.qnx.com/developers/articles/rel_5189_46.html
- http://www.securityfocus.com/bid/46838
- http://www.securityfocus.com/archive/1/516958
- http://securityreason.com/securityalert/8475
More from qnx
View All →CVE-2006-0623
QNX Neutrino RTOS 6.3.0 ships /etc/rc.d/rc.local with world-writable permissions, which...
High
7.2
CVE-2006-0622
QNX Neutrino RTOS 6.3.0 allows local users to cause a...
Medium
4.9
CVE-2006-0621
Multiple buffer overflows in QNX Neutrino RTOS 6.2.0 allow local...
High
7.2
CVE-2006-0620
Race condition in phfont in QNX Neutrino RTOS 6.2.1 allows...
Medium
6.2
CVE-2006-0619
Multiple stack-based buffer overflows in QNX Neutrino RTOS 6.3.0 allow...
Medium
4.6
Affected Vendor
Affected Software
neutrino rtos
Vulnerable Versions:
6.5.0
Timeline
Official Publish:
October 18th, 2011
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.