Subject: Pine 4.02 Patch "A" now available

From: Michael Seibel <[email-masked]>
Date: Fri, 7 Aug 1998 15:48:30 -0700 (PDT)

It has recently come to our attention that the current Pine release,
version 4.02, is susceptible to some of the same MIME-header overflow
vulnerabilities that have been discovered in various other mail user
agents.

While we're aware of no specific attacks that exploit these problems, we
are making the following patch available which will help reduce the
chances that such an attack will be successful.

While we've taken every precaution to ensure that this small set of
changes introduce no new instability, as with any new release, please
verify that this is the case in your environment.

A more complete patch description can be found in:

        ftp://ftp.cac.washington.edu/pine/pine4.02A.patch.readme

The patch itself is available from:

        ftp://ftp.cac.washington.edu/pine/pine4.02A.patch

This file is also available via the Pine Information Center at: 

        http://www.washington.edu/pine/

As always, Thanks for your interest and enjoy!

Sincerely,

The Pine Development Team

-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------

-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------

---

From: Chris Wood <[email-masked]>
Date: Sat, 8 Aug 1998 12:05:07 -0600 (MDT)

I've never added a patch to Pine, so I apologize for my ignorance.... I do
not seem to have the "patch utility" used to apply the patch.  I would
assume this was a compiler utility, no?  Any ideas?

-=-=-=-=-=-
Chris Wood                         Kitco, Inc.
801-489-2097                       Wencor West, Inc.
[[email-masked]]                 Durham Aircraft Services
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

---

From: "Ed Greshko" <[email-masked]>
Date: Mon, 10 Aug 1998 01:22:44 +0800

Chris,

> assume this was a compiler utility, no?  Any ideas?

"patch" is a utility.  You can pick up the source at the following location:

ftp://prep.ai.mit.edu/pub/gnu/patch-2.5.tar.gz

Regards,
Ed

--
Edward M. Greshko                  Technical Manager, Electronic Commerce
GSM: +65-9751-0860                 Control Data Asia/Pacific Region
PGPKey-ID:CA3AFA5D  Fingerprint: 2DE6 5527 144E D1BC  3C55 9FA5 518E 52EE