CVE-2003-1474 Privilege escalation in n/a
Local users in the games group can modify slashem-tty to execute arbitrary code as other users due to insecure file permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2003-1474?
CVE-2003-1474 is a high-severity vulnerability in n/a, published on 24 Oct 2007. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
slashem-tty in the FreeBSD Ports Collection is installed with write permissions for the games group, which allows local users with group games privileges to modify slashem-tty and execute arbitrary code as other users, as demonstrated using a separate vulnerability in LTris.
Weakness: CWE-264
Which versions are affected by CVE-2003-1474?
It affects 1 product.
Products include Freebsd Slashem-Tty.
How do I fix CVE-2003-1474?
No fix has been published for CVE-2003-1474 yet. Limit exposure of the affected software until one is available.
Is CVE-2003-1474 being exploited?
There is no known exploitation of CVE-2003-1474 in the wild and no public exploit code.
Sources
Also known as GHSA-525w-wcmh-7q9w.