Subject: Re: Shell access

From: Michael Schuyler <[email-masked]>
Date: Wed, 7 Jun 1995 14:15:22 -0700 (PDT)

On Wed, 7 Jun 1995, Dave Halsema wrote:

> >  By now the word is out that it is fairly easy to gain access to a shell 
> >from within Pine. With 3.91 you can check the enable-alternate-editor 
> >option and list your editor as "bash" or "csh" or whatever. Even if the 
> >administrator has pine.conf.fixed set up as no-enable-alternate-editor it 
> 
> I played around with this a little bit and it seems that one work around
> is to set the editor variable to "" in the pine.conf.fixed file, so it
> looks like this:
> 
>     # Specifies the program invoked by ^_ in the Composer,
>     # or the "enable-alternate-editor-implicitly" feature.
>     editor=""
> 
> Basically, it still allows the user to run an alternate editor, but
> the editor is "nothing", so no harm done.  Even if the user writes
> a .pinerc in their home directory with the editor line set to
> something else, they cannot invoke it.  If you can prove me wrong
> on this, please do.  :-)

Okay. Your method works if you just compose a message and hit Ctrl-_ to 
invoke the non-existent editor, but if youi type vsh or bash as the first 
line of your message, THEN hit Ctrl-_ to "invoke external editor," then 
VOILA! you have a shell available.

If messages bounced to this machine within the last 48 hours it is 
because this method was used on us to invoke a fork bomb and shut down
our system. 

      o o o o o o o . . .   _~~~~~~~~~~~~~~~~~~~~~\_ _~LinkNet~~~~~~\_
    o      _____            |   Kitsap Regional    | |   Support     |
  .][__n_n_|DD[  ====_____  |      Library         | |'least we try! |
 >(________|__|_[_________]_|______________________|_|_______________|_
 _/oo OOOOO oo`  ooo   ooo  'o^o^o            o^o^o` 'o^o         o^o`
========================================================================
Support: (360) 405-9131 Fax:(360) 405-9128 [email-masked]
Michael Schuyler:     Voice:(360) 405-9139 [email-masked]