Subject: Re: Pine Mail Client Bug (fwd)

From: Jim Carpenter <[email-masked]>
Date: Mon, 25 Aug 1997 11:42:30 -0400

At 09:02 AM 8/25/97 -0600, Lea wrote:
>> Hello Everyone. I would like to announce that I have discovered what appears
>>to be a rather serious bug in the Pine Mail Client, that allows a user of
>>Pine to overwrite ANY file, with ANY permissions or ownerships in their home
>>directory (including sub-directorys).
>>
>> This bug can be used to overwrite a protected login script, or to overwrite
>>a resource file (like .pinerc). This can be of serious concern to those that
>>use Pine as a shell for users, as this can allow them to modify or create
>>files that could be used to gain shell access. (Such as .rhosts, .forward,
>>etc.)
>>
>> All that is required to exploit this apparent bug is to open up a message
>>attachment using the Pine attachment viewer, and save the attachment.
>> If you want to overwrite ANY file anywhere in the users home directory,
>>just enter the file name and select overwrite. This does not work outside
>>of the users home directory BTW.
>>
>> The interesting thing about this is that it appears to completly bypass any
>>filesystem level security (permissions, owner, etc.). Also, when pine
>>overwrites the file it sets the mode to 622 (-rw-r--r--) and the owner to
>>the current user. (The pine executable IS NOT setuid root.)

OUCH! I just tried this on our system (we're running HP-UX 10.01) and it
"works" here too! I even changed a file to root ownership, read only, and it
did exactly as described above -- overwrote the file, changed the mode to
622 and the ownership to me.

Has a bug report been sent to the development team on this one?

Thanks for the warning!

Jim Carpenter
Manager of Student Information Systems
Eastern College
Saint Davids, PA

---

From: Ray Cummins <[email-masked]>
Date: Mon, 25 Aug 1997 12:00:29 -0400 (EDT)

> 622 and the ownership to me.

Now I know why I've always been a fan of "chflags schg" ;)

---

From: Alan Thew <[email-masked]>
Date: Mon, 25 Aug 1997 19:00:32 +0100 (BST)

Try just deleting the file with rm, that's all pine does (well it does an
unlink() ).

--
Alan Thew                                       [email-masked]
Computing Services,University of Liverpool      Fax: +44 151 794-4442