NetBSD has acknowledged some vulnerabilities in hack, which can be exploited by malicious, local users to gain escalated privileges.

1) A boundary error within the "gethdate()" function when processing the "PATH" environment variable can be exploited to cause a buffer overflow.

2) A boundary error within the "main()" function when processing the "GENOCIDED" environment variable in wizard mode can be exploited to cause a buffer overflow.

Successful exploitation may allow the execution of arbitrary code with the privileges of the "games" group.

Solution
Fixed in the CVS repository. See vendor advisory for details.

Provided and/or discovered by
NetBSD credits David A. Holland.

Original Advisory
NetBSD-SA2009-007:
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-007.txt.asc

Deep Links
Links available to Secunia VIM customers