Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp) as distributed in FreeBSD 6.3 and 7.0 OpenBSD 4.1 and 4.2 and the net/userppp package for NetBSD allows local users to gain privileges via long commands containing \~\ characters.