CVE-1999-0820: Medium severity FreeBSD FreeBSD vulnerability
FreeBSD seyon allows users to gain privileges via a modified PATH variable for finding the xterm and seyon-emu commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
FreeBSD seyonfrom your environment.If seyon is not required, uninstall/remove the seyon package from affected systems to eliminate the vulnerable functionality.
- Configuration
Modify seyon so it does not rely on the caller's PATH when invoking xterm and seyon-emu: call those programs by absolute path or explicitly sanitize/clear the PATH environment variable prior to executing external commands.
FreeBSD seyon PATH handling / external-command invocation = use absolute paths or sanitize/clear PATH before executing xterm and seyon-emu - Compensating control
Restrict who can run seyon and seyon-emu and ensure the xterm and seyon-emu binaries are owned by root and not writable by unprivileged users. Limit access via filesystem permissions or local access controls to reduce risk until a code fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0820?
CVE-1999-0820 has a moderate severity rating as it allows local users to gain elevated privileges.
How do I fix CVE-1999-0820?
To fix CVE-1999-0820, ensure that the PATH variable is set properly and remove any malicious directories from the PATH.
Who is affected by CVE-1999-0820?
CVE-1999-0820 affects users running FreeBSD version 3.3 that have access to the seyon application.
What are the implications of CVE-1999-0820?
The implications of CVE-1999-0820 include unauthorized privilege escalation which could lead to compromised system integrity.
When was CVE-1999-0820 reported?
CVE-1999-0820 was reported in the year 1999, highlighting a long-standing security concern in FreeBSD systems.