Subject: Lock file world writeable?

From: Joseph Karam <[email-masked]>
Date: Tue, 15 Jul 1997 13:52:27 -0400 (EDT)

Hello,

I just joined this mailing list today and I could not find any
information in the archives regarding this problem that we found
in Pine 3.96 last week.

We have found that when you go into Pine 3.96, a lock file gets created
in our /tmp area of the system.  This lock file has world read-write
permissions on it.  For example:

-rw-rw-rw-   1 jkrm     consult        5 Jul 11 14:50 /tmp/.78.16ae

So, if someone knows the name of this file and the location of it,
anyone on the system can remove it and then create a new file in its
place with the same name.  This prevents the original user who owned
the lock file from removing it and using pine properly.

This also causes Pine to think that the person's inbox is locked and 
pine will make the inbox read only.  Here are the errors we got from
the Pine debug files:

-----------------------------------------------------------------------
Userid: ucc4038
Fullname: "Iolanthe UCCtest"
User domain name being used ""
Local Domain name being used "cc.rochester.edu"
Host name being used "uhura.cc.rochester.edu"
Mail Domain name being used (by c-client too)"uhura.cc.rochester.edu"
---- write_pinerc ----
Context mail/[] type: LOCAL
new win size -----<24 80>------
Terminal type: vs100
Context mail/[] type: LOCAL
Context *{news.cc.rochester.edu/nntp}[] type: REMOTE BBOARD OLDTECH
About to open folder "INBOX"    inbox: "INBOX"
IMAP 14:01:48 7/11 mm_log ERROR: SECURITY ALERT: hard link to lock name!
IMAP 14:01:48 7/11 mm_log warn: Can't open mailbox lock, access is readonly
Opened folder "/var/mail/ucc4038" with 4 messages
Sorting by Arrival
IMAP 14:01:48 7/11 mm_log babble: Find of mailbox outside context: /u/guest/test
/ucc4038/.pine-interrupted-mail
- mailcap_free -

-------------------------------------------------------------------------

So, if someone does this to another person, they have essentially made
it impossible for the person to delete any mail from their INBOX.  

This isn't really a security concern, but more of a nuisance than
anything.  If someone does this to another user, all they are doing
is preventing the person from deleting any mail from their INBOX.  They
can't get any system privileges or read the users mail (we think). 

Do we have our Pine configured incorrectly?  Is there anyway to have 
pine use the umask of the person in setting the permissions on this
lock file instead of it having to be world readable and writeable?

Any help or suggestions would be greatly appreciated.

Thank you.

Joe Karam

-- 
Joe Karam                               UNIX Systems and Consulting Group
[email-masked]             U. of Rochester Computing Center
(716) 275-9166                          Taylor Hall, Room 21A