Scanit Labs has reported a vulnerability in QNX Momentics, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error in /usr/photon/bin/phgrafx when handling .pal files in the PHOTON_PATH\palette folder. This can be exploited to cause a stack-based buffer overflow via a .pal file with an overly long (greater than 285 characters) filename placed in the "palette" folder.

The vulnerability reportedly affects version 6.3.2 and prior.

Solution
The vendor recommends clearing the setuid bit for phgrafx.

Provided and/or discovered by
Filipe Balestra and Rodrigo Rubira Branco, Scanit Labs

Changelog
Further details available in Customer Area

Original Advisory
http://www.scanit.net/rd/advisories/adv01

Deep Links
Links available in Customer Area