Subject: pine/pico for freenet software

From: Ken Kutz<[email-masked]>
Date: Thu, 19 May 94 10:01:11 -0400

We are implementing a captive menu system and would like to use pine
and pico as the MUA and editor of choice.  Are you aware of any
security problems (i.e. ways of escape such as shell escapes etc.)
from either of these programs?

Secondly, would you have any references for us of people who are using
pine and pico in this fashion?

Thanks very much.

Ken

---

From: Muriel McKay <[email-masked]>
Date: Thu, 19 May 1994 10:28:25 -0400 (EDT)

unsubscribe

---

From: Philip Hazel <[email-masked]>
Date: Thu, 19 May 1994 16:00:42 +0100 (BST)

> from either of these programs?

Yes!

We had a hard time with our students last October, on an untried system.

We had to hack pine to prevent the users setting up a personal printer 
command. We also had to set the global configuration so that any attempt to 
enter an "alternate editor" just ran a script that said "sorry, you can't 
use an alternate editor". 

I think our other problems were not specifically related to Pine, but to 
the Perl scripts that implement our menu system. (Don't, for example, let a 
user type a file name and then just obey Perl's "open" command on it 
without checking its contents. They don't take long to discover that typing 
names such as "|sh" give interesting effects...)

Philip

--
Philip Hazel                   University Computing Service,
[email-masked]             New Museums Site, Cambridge CB2 3QG,
[email-masked]          England.  Phone: +44 223 334714