Secunia

Two privilege escalation vulnerabilities have been identified, one in LTris and another in SlashEM. In combination these could be used to gain the privileges of any user executing "slashem-tty".

A buffer overflow in the handling of the "HOME" environment variable has been identified in LTris. This allows malicious local users to execute code with privileges of the "games" group.

Normally "games" group privileges can't be used for much. However, certain slashem files are writeable by the "games" group. This can be exploited in a way that will allow the malicious user to execute arbitrary code with the privileges of any user that executes "slashem-tty".

This has been proven in the freebsd ports LTris 1.0.1 and slashem-tty-0.0.6E.4F.8.

An exploit has been released.

Solution
Remove any games from your production systems.
Further details available in Customer Area

Provided and/or discovered by
Knud Erik Højgaard/kokanin

Deep Links
Links available in Customer Area