Subject: pine 3.07 bug and paranoia

From: Jeff Earickson <[email-masked]>
Date: Mon, 5 Apr 1993 14:25:52 -0500 (CDT)

Hi again,

Pine seems to core dump upon finishing when you run pine within an xterm
window.  I originally reported this bug back with 3.04, and it got fixed
in 3.05.  Its back...  I thought at the time that it had to do with the
"Pine Finished" message trying to print while the xterm window is dying.
Why is this message in the code anyway?  It is useless and un-Unix.

On another subject, why is Pine in the business of changing passwords, or
even monkeying with the password part of the getpwent structure at all??!!
I find it disturbing and offensive to discover my encrypted password buried
in the .pine-debug file.  Being the paranoid individual that I am, I 
envision nefarious uses of this information by parties unknown.  After all, 
this IS a mail program, so encrypted passwords could be mailed off without 
the user's knowledge.  I think that pine-central should consider removing
the password manipulations from this fine program....

/*------------------------------------------------------------------------*/
/* Jeff Earickson, Cray/nCUBE/Sun Consultant|e-mail: [email-masked] */
/* Alabama Supercomputer Network            |  Work Phone: (205) 348-3969 */
/* Boeing Computer Services                 |    Work Fax: (205) 348-3993 */
/* Address: PO Box 870346, University of Alabama, Tuscaloosa, AL 35487    */
/*       Alabama 13-0-0, 1992 National Football Champions. Roll Tide!     */
/*                                                                        */
/* Caduceus, n. [Latin]: a shaft with two snakes entwined around it in a  */
/*    strangling embrace, historically used as the symbol of the medical  */
/*    profession.  In modern times, this symbol has become more           */
/*    appropriate to the legal profession....                             */
/*------------------------------------------------------------------------*/

---

From: "Michael J. Corrigan" <[email-masked]>
Date: Mon, 05 Apr 1993 14:15:50 -0700

...
     On another subject, why is Pine in the business of changing passwords, or
     even monkeying with the password part of the getpwent structure at all??!!
     I find it disturbing and offensive to discover my encrypted password burie
    d
     in the .pine-debug file.  Being the paranoid individual that I am, I 
     envision nefarious uses of this information by parties unknown.  After all
    , 
     this IS a mail program, so encrypted passwords could be mailed off without
     
     the user's knowledge.  I think that pine-central should consider removing
     the password manipulations from this fine program.

...

I don't agree that the password changing menu item needs to be removed from
pine.     

Pine doesn't change passwords or monkey with the password part of
the getpwent structure. It calls the system "/bin/passwd" the same
as you would to change passwords. It is just providing a full-screen
menu - item for changing passwords - as do many full-screen menu
interfaces to Unix.

The password in my .pine-debug file looks like:
Password: *
Since we run shadow passwords on our system the encrypted password is not 
kept in /etc/passwd, just an asterik appears in the passwd part of /etc/passwd
Since pine has no special privileges the only way it could get the
encrypted password entry into your .pine-debug file is if the
/etc/passwd file is world-readable.
Therefore, anyone on your system can mail your encrypted password entry off
by mailing /etc/passwd. This is a lot more obvious place to look for
your encrypted password entry than your personal .pine-debug file.
The best solution to this security hole - and it *is* a security hole -
is to install shadow passwords.

-Mike Corrigan