CVE-2003-1474: High severity FreeBSD slashem-tty vulnerability
slashem-tty in the FreeBSD Ports Collection is installed with write permissions for the games group, which allows local users with group games privileges to modify slashem-tty and execute arbitrary code as other users, as demonstrated using a separate vulnerability in LTris.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove write access for the 'games' group from the installed slashem-tty file(s). For example, as root run: chmod g-w /path/to/slashem-tty (apply to all installed slashem-tty binaries/scripts) and verify ownership/group are appropriate.
slashem-tty (FreeBSD Ports Collection) group 'games' write permission = remove (no group write)
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1474?
CVE-2003-1474 is considered a high severity vulnerability due to the potential for local users to execute arbitrary code.
How do I fix CVE-2003-1474?
To fix CVE-2003-1474, change the permissions of slashem-tty to remove write access for the games group.
Who is affected by CVE-2003-1474?
Local users who have group memberships in the games group on affected systems are at risk from CVE-2003-1474.
What software versions are affected by CVE-2003-1474?
CVE-2003-1474 affects slashem-tty version 0.0.6e.4f.8 in the FreeBSD Ports Collection.
Can CVE-2003-1474 be exploited remotely?
CVE-2003-1474 is not a remotely exploitable vulnerability as it requires local access to the system.