QNX Technical Articles

Date of this edition: July 21, 2005

Target OS: QNX^® Neutrino^® 6.3.0 or 6.3.0 SP1

Host OS: Microsoft Windows XP SP1 or SP2, 2000 SP4, or NT SP6a; Sun Solaris 7, 8, or 9; QNX^® Neutrino^® 6.3.0 or 6.3.0 SP1; Linux Red Hat 8, 9, or Enterprise (but QNX Momentics will likely work on other versions of Linux)

For information on installing this patch, see the installation note. For the most up-to-date version of these release notes, log into your myQNX account, and then go to the Download Center area of www.qnx.com. If you've installed the Extended Networking TDK, you should also install its security patch.

Contents

• What's in this patch?
• Fixed issues
• Known issues
• Technical support

Throughout this document, you may see reference numbers associated with particular issues, changes, etc. When corresponding with our Technical Support staff about a given issue, please quote the relevant reference number. You might also find the reference numbers useful for tracking issues as they become fixed.

What's in this patch?

Binaries

This patch contains security updates to the following:

• slinger
• telnetd

Installed files

These files are installed under $QNX_TARGET, under the subdirectories for each supported target platform:

• ARMBE:
  • armbe/usr/sbin/slinger
  • armbe/usr/sbin/telnetd
• ARMLE:
  • armle/usr/sbin/slinger
  • armle/usr/sbin/telnetd
• MIPSBE:
  • mipsbe/usr/sbin/slinger
  • mipsbe/usr/sbin/telnetd
• MIPSLE:
  • mipsle/usr/sbin/slinger
  • mipsle/usr/sbin/telnetd
• PPCBE:
  • ppcbe/usr/sbin/slinger
  • ppcbe/usr/sbin/telnetd
• SHLE:
  • shle/usr/sbin/slinger
  • shle/usr/sbin/telnetd
• x86:
  • x86/usr/sbin/slinger
  • x86/usr/sbin/telnetd

Fixed issues

This patch addresses the following issues:

slinger

• Slinger used to allow a remote user to access files outside of its root directory (as identified by the HTTPD_ROOT_DIR environment variable) by including ../ in the URI of the request sent to slinger (e.g. http://hostname/././../../etc/passwd).

  Slinger tried to keep track of how far into the directory tree it went, but this wasn't reliable and could be defeated by adding ./ before the ../ in the path. Slinger doesn't provide support to write to the filesystem, and accesses files as user ID -2. It now removes any ../ strings from the URI before processing. (Ref# 21825)

• A large HTTP GET request-URI (greater than the value of PATH_MAX) formerly could overflow Slinger's internal buffer and cause a fault. This has been fixed. (Ref# 21965)

telnetd

During the initialization of the telnet link, if the client sent a large number of parameters to negotiate, telnetd used to overrun its reply buffer with the responses to all of the request's parameters. The telnetd daemon now flushes the buffer if it becomes full. (Ref# 21965)

Known issues

rcp

This utility sets its user ID to root. It was reported that you can overrun the source/target file argument buffers in the utility, giving yourself root access. Under QNX Neutrino, rcp spawns the cp utility for local file-copying operations; it's the cp utility that faults. When rcp spawns cp, it does so with the credentials of the user who launched rcp, rather than root's. (Ref# 22002)

Technical support

If you have any questions, comments, or problems with a QNX product, please contact Technical Support. For more information, see the How to Get Help chapter of the Welcome to QNX Momentics guide or visit our website, www.qnx.com.