Description
bctool in Jetico BestCrypt 0.7 and earlier trusts the user-supplied PATH to find and execute an fsck utility program, which allows local users to gain privileges by modifying the PATH to point to a Trojan horse program.
References
- 20010604 Fatal flaw in BestCrypt <= v0.7 (Linux) mailing-list
- 2820 vdb-entry
- bestcrypt-bctool-gain-privileges(6648) vdb-entry
- http://www.jetico.com/index.htm#/linux.htm