The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.
| Software | From | Fixed in |
|---|---|---|
| netbsd / netbsd | 1.5 | 1.5.x |
| netbsd / netbsd | 1.4.2 | 1.4.2.x |
| netbsd / netbsd | 1.5.1 | 1.5.1.x |
| netbsd / netbsd | 1.4.3 | 1.4.3.x |
| netbsd / netbsd | 1.4 | 1.4.x |
| netbsd / netbsd | 1.4.1 | 1.4.1.x |