rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to gain privileges by specifying an alternate Trojan horse script on the command line.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bsd_os | Bsdi | 3.0 (including) | 3.0 (including) |
| Bsd_os | Bsdi | 3.1 (including) | 3.1 (including) |
| Bsd_os | Bsdi | 4.0 (including) | 4.0 (including) |
| Bsd_os | Bsdi | 4.0.1 (including) | 4.0.1 (including) |