Tridium Niagara Affected by BlackBerry QNX Vulnerabilities

mood · Oct 1, 2019

Tridium Niagara Affected by BlackBerry QNX Vulnerabilities
September 30, 2019
https://www.securityweek.com/tridium-niagara-affected-blackberry-qnx-vulnerabilities

Niagara is a popular framework designed for connecting and controlling a wide range of Internet of Things (IoT) devices present in buildings, factories and smart cities. CISA says the product is used worldwide, particularly in the commercial facilities, government facilities, critical manufacturing and IT sectors.

The QNX operating system images distributed by Tridium, a subsidiary of Honeywell, are affected by a couple of recently disclosed vulnerabilities. The security holes impact Niagara AX 3.8u4, Niagara 4.4u3 and Niagara 4.7u1.
The more serious of the two vulnerabilities, tracked as CVE-2019-8998 with a CVSS score of 7.8, was reported to BlackBerry by Johannes Eger and Fabian Ullrich of the Secure Mobile Networking Lab at TU Darmstadt in Germany.

According to an advisory published by BlackBerry in July, CVE-2019-8998 is an information disclosure issue related to the procfs service and it can be exploited for local privilege escalation.
Click to expand...

“QNX (like most UNIX systems) has the process memory of all processes mapped to the file system (therefore the process memory can be easily used by other programs). This is also called the 'procfs'. [...] In the vulnerable QNX versions these access controls were wrongly configured [...]"

He added, “On a very high level this means an attacker is able to steal any data that resides in any processes' memory at the time of the attack - this includes SSL secrets, private keys, and possibly passwords.”
Click to expand...

Log in or Sign up

Tridium Niagara Affected by BlackBerry QNX Vulnerabilities

mood Updates Team