CVE-1999-0821

Vulnerability

FreeBSD 3.3-RELEASE includes the communications program Seyon, which is installed as a setgid dialer. This allows local users to exploit vulnerabilities within Seyon to elevate their privileges. The specific vulnerability allows a malicious program to be provided via the -emulator argument [1].

Exploitation

A local user can exploit this vulnerability by creating a malicious program, such as a C program that executes /usr/bin/id, compiling it, and then executing Seyon with the -emulator argument pointing to the compiled malicious program. This causes Seyon to execute the malicious program with the group privileges of the dialer group [1].

Impact

Successful exploitation allows a local user to gain privileges that grant access to communications devices or other resources accessible by the dialer group. This effectively elevates the user's group privileges to include the dialer group [1].

Mitigation

This vulnerability is present in FreeBSD 3.3-RELEASE. Information regarding a fixed version or patch is not available in the provided references. Users are advised to check for updated advisories or consider removing or disabling the Seyon utility if it is not essential [1].