Subject: Pine Mail Client Bug (fwd)

From: Lea <[email-masked]>
Date: Mon, 25 Aug 1997 09:02:32 -0600 (MDT)

This was sent to me by one of our users this morning.  I cruised
comp.mail.pine and didn't see any reference to it.  Given the
nature of the 'bug', we have more than a few very concerned
users.  I've tried to recreate the problem without success, but
then again, I'm not running Pine on a Linux system... Anyone
have a clue?

Much appreciated.

Lea
---------- Forwarded message ----------
Date: Mon, 25 Aug 1997 08:15:40 -0600
Subject: Pine Mail Client Bug (fwd)

>just got this from bugtraq... are you protected?
>
>---------- Forwarded message ----------
>Date: Wed, 20 Aug 1997 23:27:32 -0700
>From: Jesse Brown <[email-masked]>
>To: [email-masked]
>Subject: Pine Mail Client Bug
>
> Hello Everyone. I would like to announce that I have discovered what appears
>to be a rather serious bug in the Pine Mail Client, that allows a user of
>Pine to overwrite ANY file, with ANY permissions or ownerships in their home
>directory (including sub-directorys).
>
> This bug can be used to overwrite a protected login script, or to overwrite
>a resource file (like .pinerc). This can be of serious concern to those that
>use Pine as a shell for users, as this can allow them to modify or create
>files that could be used to gain shell access. (Such as .rhosts, .forward,
>etc.)
>
> All that is required to exploit this apparent bug is to open up a message
>attachment using the Pine attachment viewer, and save the attachment.
> If you want to overwrite ANY file anywhere in the users home directory,
>just enter the file name and select overwrite. This does not work outside
>of the users home directory BTW.
>
> The interesting thing about this is that it appears to completly bypass any
>filesystem level security (permissions, owner, etc.). Also, when pine
>overwrites the file it sets the mode to 622 (-rw-r--r--) and the owner to
>the current user. (The pine executable IS NOT setuid root.)
>
> I have verified this behavior on Pine version 3.95 & 3.96 on Linux systems.
>So far I have not been able to find a version or system that is not
>susceptable.
>
> I do not currently know of any patch or fix for this behavior.
>
>   Sincerly,
>     Jesse Brown
>
>
>
>

---

From: Jeff <[email-masked]>
Date: Mon, 25 Aug 1997 13:44:05 -0400 (EDT)

On Mon, 25 Aug 1997, Lea wrote:

[...]

> >So far I have not been able to find a version or system that is not

Last I knew, this was standard unix proceedure. Pine just makes it a
little easier. If Pine is not running setuid root, there is no way that it
can allow a user to overwrite a file which they "should not" be able to
overwrite. Pine can only do what the user would be able to do under normal
conditions.

Since the user owns the directory enclosing the files, they can delete the
files within that dir, etc.

Just from what I've experienced- maybe I'm missing the point here?

-jeff

---

From: Yossi Itzkovich <[email-masked]>
Date: Tue, 26 Aug 1997 08:09:42 +0300 (IDT)

Hi,

Where can I get a list of NNTP server that Pine can work with ?

I usually get (the sever doesn't trust you etc.)

Thanks,

Yossi

---

From: Jeff <[email-masked]>
Date: Tue, 26 Aug 1997 01:12:54 -0400 (EDT)

> I usually get (the sever doesn't trust you etc.)

Errors such as "You have No Permission to talk" mean just that. It takes a
good deal of time and money to operate an NNTP server, since new articles
alone may account for a gigabyte or more in daily traffic, to say nothing
of the number of people who read those articles, etc. 

You can find many lists of "Public NNTP Servers", and perhaps your easiest
place to start would be Yahoo, by searching for "free NNTP" or "free news
server". There is an established category for such lists.

Alternately, you could determine if your network provider offers a news
server for your use.

-jeff