Skip to end of metadata
Go to start of metadata

You are viewing an old version of this content. View the current version.

Compare with Current View Version History

« Previous Version 4 Current »

Problem:

Two vulnerabilities have been discovered in the QNX operating system images distributed by Tridium.
The first vulnerability is related to a vulnerability that could allow a less privileged process to gain read access to privileged files.
The second is related to a vulnerability in the QNX procfs service that could allow a less privileged process to gain access to a chosen process's address space.
 
The following supported platforms are impacted: 

  • Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000)
  • Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000)
  • Niagara 4.7u1 (JACE-8000, Edge 10)

 
 
NOTE: Niagara Windows and Linux Supervisor installations are not impacted.
 


Solution:

Installing the patched files for the affected versions will remedy the issue. 

Installation Instructions

Archive file ‘Qnx Patches for HAREMB-1220 and 1221.zip’ contains folders for Niagara Ax 3.8 update 4 (r38), Niagara 4.4 update 3 (r44) and, Niagara 4.7 update 1 (r47).


  1. Unzip the zip archive into a temporary working folder.
  2. Make sure you have the corresponding version of Niagara Workbench installed.
  3. Copy the dist files from the folder (r38, r44 or r47) for that release into:
    1. <niagara_user_home> \ sw \ inbox 


Note: <niagara_user_home> in N4 is your windows profile user folder \ Niagara4.x \<brandId> 

Example:

C:\users\myUserName\Niagara4.7\tridium\sw\inbox


Note: In Ax the niagara_user_home is the location where you installed.

Example:

C:\Niagara\Niagara-3.8.401\sw\inbox


  1. Restart the version of Workbench you are updating.
  2. Connect to the platform of the device
  3. Open the Software Manager
  4. Observe the files are no longer in the inbox of the user home
  5. Commission the device using the “Commissioning Wizard”
    1. Make sure the “install/upgrade core software from distribution files” box is checked
    2. Confirm the version number of the dists being installed
ProductQNX Patches
Niagara AX 3.8u4OS Dist: 2.7.402.2
NRE Config Dist: 3.8.401.1
Niagara 4.4u3

OS Dist: 4.4.73.38.1

NRE Config Dist: 4.4.94.14.1

Niagara 4.7u1

OS Dist: (JACE 8000) 4.7.109.16.1
OS Dist (Edge 10): 4.7.109.18.1

NRE Config Dist: 4.7.110.32.1

  • No labels