CVE-1999-0863: Buffer Overflow
Buffer overflow in FreeBSD seyon via HOME environmental variable, -emulator argument, -modems argument, or the GUI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
FreeBSD seyonfrom your environment.Uninstall or remove the seyon component from affected systems or otherwise prevent it from being executed until an official patch/fix is available.
- Configuration
Ensure the HOME environment variable is sanitized or cleared before launching seyon (for example, run seyon from a wrapper that unsets or sets HOME to a safe value).
seyon HOME environment variable handling = sanitize/clear - Configuration
Prevent use of the -emulator and -modems command-line arguments (for example, use a wrapper to strip/validate arguments or configure invocation to avoid these arguments) until a patch is available.
seyon command-line arguments (-emulator, -modems) = do not accept/use - Configuration
Disable or avoid using the seyon graphical interface (GUI) until an official fix is released.
seyon GUI GUI enabled = false - Compensating control
Restrict execution of the seyon binary to trusted administrative accounts (file permissions, exec ACLs) and prevent untrusted users from invoking it; monitor and block attempts to run seyon from untrusted contexts.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0863?
CVE-1999-0863 is considered a critical vulnerability due to its potential to allow arbitrary code execution via a buffer overflow.
How do I fix CVE-1999-0863?
To fix CVE-1999-0863, users should upgrade to a patched version of FreeBSD that addresses this vulnerability.
What systems are affected by CVE-1999-0863?
CVE-1999-0863 specifically affects FreeBSD version 3.3.
Can CVE-1999-0863 be exploited remotely?
Yes, CVE-1999-0863 can be exploited remotely if the vulnerable software is exposed to untrusted users.
What are the potential impacts of CVE-1999-0863?
The potential impacts of CVE-1999-0863 include system crashes and unauthorized remote code execution.