Subject: Potential security problems in pine 3.87

From: [email-masked] (Jordi Renye)
Date: 18 Dec 1995 10:19:17 GMT

We want to install pine in our site to allow easy management of mime messages.

  - Is there  any known security bugs in this version of pine?

                            wwWWww
                            [o][o]
------------------------ooO--(__)--Ooo--

                    -Internet-                Alberto Robles.
 "But soon, soon, soon, the world will be     Becario de Comunicaciones
 a better place, with meadows and bunnies     [email-masked]
 and fiber optics in every home.... "         http://www-fib.upc.es/~alberto

---

From: Mike Brudenell <[email-masked]>
Date: Mon, 18 Dec 1995 12:25:36 +0000 (GMT)

The question is semi-academic...

After Pine 3.87 came version 3.89, then 3.90, followed by 3.91 (the 
current version).

I would strongly urge you to obtain and install 3.91 in preference to 
3.87 as it contains *many* enhancements, particularly in the ability to 
configure it.

As far as I am aware of there are no security problems in any of the 
versions of Pine (that I recall).  However if you are wanting to run it 
under a restricted shell you may find that users can read files (eg, into 
messages being composed) that they would not otherwise be able to.

I think some discussion about the use of Pine within a restricted shell 
environment has occurred in the not too distant past.  If this is 
applicable to you you may be able to find the discussion in the 
"Pine-Info" archives accessible from the Pine Information Centre on the 
World-Wide Web:

	http://www.washington.edu:1180/pine/

Cheers,

Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/

---

From: Tim Pierce <[email-masked]>
Date: Mon, 18 Dec 1995 17:58:16 GMT

In article <[email-masked]>,

>3.87 as it contains *many* enhancements, particularly in the ability to 

It also contains a certain enhancement that a lot of people view
as a very serious design flaw, which the poster might wish to take
into account.

-- 
By sending unsolicited commercially-oriented e-mail to this address, the 
sender agrees to pay a $100 flat fee to the recipient for proofreading 
services.

---

From: [email-masked] (Rick Troxel)
Date: Tue, 19 Dec 1995 02:32:31 GMT

In article <[email-masked]> [email-masked] (Jordi Renye)
writes:

I too would recommend searching the newsgroup archives.

The only security issue mention of which I seem to recall seeing is
system(3) calls in which the called utilities lack full pathnames,
making the caller vulnerable to trojan horse utilities.  Of course, pine
would not be the only potential victim of such trojans.

This is not limited to v3.87.

Best regards,
--
Rick Troxel     [email-masked]     [email-masked]     301/496-4824
///////////////////////////////////////////////////////////////////////////
     All effort and exertion put forth by man from the fullness of his
     heart is worship, if it  is prompted  by the  highest motives and
     the will to do service to humanity.                 --Abdu'l-Baha