CVE-2017-3891 - In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node

Back Back to CVE browser

CRITICAL

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node

Published Nov 14, 2017

9.6

CRITICAL

CVSS 3.1

EPSS 1.28%

Description

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.

Affected products

Vendor BlackBerry Product QNX Software Development Platform (QNX SDP) Default
unaffected
- Version
  6.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

BlackBerry

QNX Software Development Platform (QNX SDP)

unaffected

Version	Status	Constraints
6.6.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-863

Incorrect Authorization

CWE-923

References (2)

http://support.blackberry.com/kb/articleDetail?articleNumber=000046674
x_refsource_CONFIRMMitigationVendor Advisory
https://www.midnightbluelabs.com/blog/2017/12/8/elevation-of-privilege-vulnerability-in-qnx-qnet
x_refsource_MISC

Link	Providers	Tags
http://support.blackberry.com/kb/articleDetail?articleNumber=000046674		x_refsource_CONFIRMMitigationVendor Advisory
https://www.midnightbluelabs.com/blog/2017/12/8/elevation-of-privilege-vulnerability-in-qnx-qnet		x_refsource_MISC