Subject: RE: Pine 4.02 Patch "A" now available

From: Dave Hansen <[email-masked]>
Date: Thu, 20 Aug 1998 10:47:22 -0700

On SCO 5.x the patch utility complains about the -p option used in the
readme file for this patch.  If I don't use the -p option, it says
------------------------------------------------
Hmm...Looks like a new-style context diff to me...
The text leading up to this was:
--------------------------
|*** pine4.02/pico/composer.c.orig      Thu Jul  2 16:00:40 1998
|--- pine4.02/pico/composer.c   Wed Aug  5 10:40:25 1998
--------------------------
File to patch:       
-------------------------------------------------

Any ideas?
Thanks,
Dave

> -----Original Message-----
> From: Michael Seibel [mailto:[email-masked]]
> Sent: Friday, August 07, 1998 3:49 PM
> To: Pine Discussion Forum
> Subject: Pine 4.02 Patch "A" now available
> 
> 
> It has recently come to our attention that the current Pine release,
> version 4.02, is susceptible to some of the same MIME-header overflow
> vulnerabilities that have been discovered in various other mail user
> agents.
> 
> While we're aware of no specific attacks that exploit these 
> problems, we
> are making the following patch available which will help reduce the
> chances that such an attack will be successful.
> 
> While we've taken every precaution to ensure that this small set of
> changes introduce no new instability, as with any new release, please
> verify that this is the case in your environment.
> 
> A more complete patch description can be found in:
> 
>         ftp://ftp.cac.washington.edu/pine/pine4.02A.patch.readme
> 
> The patch itself is available from:
> 
        ftp://ftp.cac.washington.edu/pine/pine4.02A.patch

This file is also available via the Pine Information Center at: 

        http://www.washington.edu/pine/

As always, Thanks for your interest and enjoy!

Sincerely,

The Pine Development Team

-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------

-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------

---

From: Don Newcomer <[email-masked]>
Date: Thu, 20 Aug 1998 14:04:40 -0400 (EDT)

I ran into the same problem on a DEC Alpha box running Digital UNIX until I
checked the README for the patch:

The patch file itself is in context-diff format, and should be
understood by the "patch" utility.  To update Pine 4.02 source,
simply copy the patch file into the same directory as the pine4.02
source tree and type:

        patch -p < pine4.02A.patch

================================================================================
Don Newcomer                                            Dickinson College
Asst. Director of Computer Services                     P.O. Box 1773
[email-masked]                                  Carlisle, PA  17013
                                                        Phone: (717) 245-1256
                                                          FAX: (717) 245-1690