Subject: mailbox vulnerable

From: "Aaron S. Hawley" <[email-masked]>
Date: Wed, 9 Sep 1998 17:19:26 -0400 (Eastern Daylight Time)

i get the mailbox vulnerable mesage even though i've set my mail directory
to 1777 as instructed.  what am i doing wrong?  it occurs every time i
access my INBOX

i'm using pcpine 4.03

aaron

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Cliff Green <[email-masked]>
Date: Wed, 9 Sep 1998 17:32:39 -0400 (EDT)

> to 1777 as instructed.  what am i doing wrong?  it occurs every time i

And I'm getting it even though I've set quell-lock-failure-warnings.  Also
with PCPine 4.03.

c
-- 
Cliff Green
[email-masked]
Academic Computing Service, UMDNJ

---

From: Mason Loring Bliss <[email-masked]>
Date: Sat, 12 Sep 1998 01:51:52 -0400

On Wed, Sep 09, 1998 at 05:19:26PM -0400, Aaron S. Hawley wrote:

> to 1777 as instructed.

Mode 1777 is inherently vulnerable. It allows unscrupulous users to create
a mailbox in your name, if you use a client that removes your mailbox when
it empties it out, or if the unscrupulous user does it right after your
account has been set up. In either case, they'd then be able to set the
permissions on the mailbox such that it's world-readable.

A far more secure method is to have your mail directory be mode 0775, group
mail, and have your mail clients mode 2755, group mail. This prohibits
users from creating files in your mail directory without using their mail
client to do it. (Of course, if the mail client doesn't take care with what
it does, mail can still be abused. Probably the only *really* safe method
is delivery straight to users' home directories.)

-- 
Mason Loring [email-masked]..acheron.dyn.ml.org/mason
"In the drowsy dark cave of the mind dreams build their nest with fragments
  dropped from day's caravan."--Rabindranath Tagore..awake ? sleep : dream;

---

From: "Aaron S. Hawley" <[email-masked]>
Date: Sat, 12 Sep 1998 01:58:45 -0400 (Eastern Daylight Time)

so how do i do this.  i've set my mail directory to 0775, but how do i set
my mail client mode?

---

From: Terry Gray <[email-masked]>
Date: Sat, 12 Sep 1998 08:24:01 -0700 (Pacific Daylight Time)

This is VERY BAD ADVICE.  The vulnerability you are concerned about with
mode 1777 goes away if you use mail tools that don't remove the INBOX
(thousands of sites use this strategy successfully) and the
vulnerabilities of running Pine as a privileged program are ENORMOUS... it
was never designed to be run with privileges.

-teg

---

From: Mason Loring Bliss <[email-masked]>
Date: Sat, 12 Sep 1998 11:45:57 -0400

> was never designed to be run with privileges.

The worst case is that the user could use Pine to create a file in /var/mail.
Sticky bits alone on /var/mail are totally insufficient. Also, note that the
group "mail" will exist only to own /var/mail. It exists for no other reason,
and grants no privilige other than the ability to write to files in /var/mail.
At that, files are created with fairly minimal permissions, so Pine running
SGID mail can't access any files other than those it has created and those
already accessible under the user's standard permissions.

Running Pine as SUID root would be silly, but I don't see ENORMOUS problems
running it SGID mail. I see *no* problems with it, in fact, that aren't
already a subset of the ENORMOUS number of problems running with the sticky
bit set on /var/mail, mode 1777.

---

From: Terry Gray <[email-masked]>
Date: Sat, 12 Sep 1998 11:09:02 -0700 (Pacific Daylight Time)

Mason,
Your argument against mode 1777 was:

> Mode 1777 is inherently vulnerable. It allows unscrupulous users to
> create a mailbox in your name, if you use a client that removes your
> mailbox when it empties it out, or if the unscrupulous user does it
> right after your account has been set up. In either case, they'd then
> be able to set the permissions on the mailbox such that it's
> world-readable.

But exactly the same vulnerability exists in your SGID scheme if the bad
guy uses a mail client to do his harm.  The moral is: don't use mail
clients that remove empty mailboxes.  Then you don't *need* to make the
clients privileged.

> Probably the only *really* safe method is delivery straight to users'
> home directories.)

On this we agree.

-teg

---

From: Olivia Cole - Honors 101-08 <[email-masked]>
Date: Sat, 12 Sep 1998 13:14:47 -0500 (CDT)

I do NOT want to keep receiving all of these messages in the Pine
Discussion Forum. I keep getting them, and keep writing to try to get them
ceased, and no one is responding, and they keep on coming. How do I block
these messages or get off of this mailing list? Please help!!!!!! I DON'T
want to receive these!!!!!!!!!!!!!!!!!!!!!

Thank you very much!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

---

From: "Aaron S. Hawley" <[email-masked]>
Date: Sun, 13 Sep 1998 17:58:12 -0400 (Eastern Daylight Time)

what is SGID.  by the way i am running pc-pine.  i tell you this for two
reasons.  in case you are giving me the right information, and two, i
don't know anything about unix then it's complementary aspects with
MS-DOS.  i.e. i don't know anything besides how to manage a web page using
telnet.  so please explain your intelligent unix slang.  thanks

aaron

---

From: Jeff Goswick <[email-masked]>
Date: Sat, 12 Sep 1998 16:26:32 -0600 (MDT)

Dear Olivia:

Here are some exerps from the mail you should have recieved when you
subscribed the list:

<snip>

	The list's owners are [email-masked] .

	You should contact them if there are any problems.

	Please do not send requests to this list; instead direct them to:

                        	[email-masked]

	To get more information on how to use this service, please send the
        command HELP in a line by itself in a mail message to 
	[email-masked].

	To signoff from the list, email to [email-masked] with
	the following request:

                	signoff PINE-INFO
	or
                	unsubscribe PINE-INFO

<snip>

Hope this helps,
Jeff

On Sat, 12 Sep 1998, Olivia Cole - Honors 101-08 wrote:

> Date: Sat, 12 Sep 1998 13:14:47 -0500 (CDT)
> From: Olivia Cole - Honors 101-08 <[email-masked]>
> To: Pine Discussion Forum <[email-masked]>
> Subject: Re: mailbox vulnerable
>