Subject: Stopping executions of commands from within pine.

From: "Imran Shabbir" <[email-masked]>
Date: Sun, 22 Nov 1998 00:47:57 PST

Dear Friends,

I am facing a severe problem. We offer pine, lynx and ftp services to 
our users. We do not offer a shell prompts to users rather we offer 
these services through a 'text menu' interface. But for the past few 
days, I am observing a user who runs pine and within five minutes he 
runs commands like chmod ps which we do not offer in our text based menu 
for users. I think he suspends pine some how and gets a shell prompt. I 
have disabled pine suspension in pine.conf.fixed in /usr/local/lib.
The pine.conf.fixed contains:

feature-list=no-enable-unix-pipe-cmd,no-enable-alternate-editor-cmd,no-enable-suspend,no-enable-alternate-editor-implicitly,auto-move-read-msgs
The ownerships of files are given below:

-r-xr-xr-x   1 root     other    1044480 Nov  4 12:34 pico
-r-xr-xr-x   1 root     other    4285400 Nov  4 09:59 pine  

while the said user is busy in breaking the system, the output of the ps 
-aef|grep 'user' command shows the following:

jack 14183 14182  0 16:32:29 pts/0    0:00 pine
jack 14299 14183  0 16:32:58 pts/0    0:00 sh -c /home/jack/get-pswd
jack 14300 14299  0 16:32:59 pts/0    0:00 /home/jack/get-pswd

I blocked the account being mis-used but similar attempts are being done 
by many other users.

I am really worried and want to know how can I stop execution of 
commands from pine. Please help me on making pine secure. I was using 
pine 3.93 and have recently upgraded to pine 4.05 but the situation is 
same.Do I need to modify pine.conf.fixed? Do I need to change the 
ownership of pine from root to bin etc or not.( I know the hacker gets 
root previledges after he breaks pine).

Please help me....

Thanks in advance. I will summarize.

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Martin Mokrejs <[email-masked]>
Date: Sun, 22 Nov 1998 16:29:50 +0100 (MET)

> runs commands like chmod ps which we do not offer in our text based menu 

Can he stop you text-based menu? Is it a shell script? Did you use
'trap' commands to disable Ctrl+c and other interrupts?

The default editor is pico? If is it vi, he can start shell from
within that.
 
> I blocked the account being mis-used but similar attempts are being done 
As I see he can start shell immediately from pine. Disable the pipe
command from within pine.conf.fixed

Demo:

shell$ echo a |more

type !sh and have a shell

I did not repeat it right now in pine 4.05, but I believe it will work.

> root previledges after he breaks pine).

If they get root privs, you can't be sure with just anything, then you
don't need to selve such problems. backup data, reinstall system. That's
the only solution.

--
Martin Mokrejs - PGP 5.0i key at: finger://mail.natur.cuni.cz/mmokrejs
<[email-masked]> Faculty of Science, The Charles University

---

From: Darren Henderson <[email-masked]>
Date: Sun, 22 Nov 1998 11:15:43 -0500 (EST)

> The ownerships of files are given below:

I don't see anything that would stop them from doing this....

set speller to bash, compose a message with the word bash (or any other
set of commands) at the top of the file and then invoke the speller....
works like a charm.

Add speller to your fixed file.

Also as someone else has already pointed out... if they have already
gotten root stop, reinstall, and start again.

______________________________________________________________________
Darren Henderson                              [email-masked]

                   Help fight junk e-mail, visit http://www.cauce.org/

---

From: Jim Sander <[email-masked]>
Date: Mon, 23 Nov 1998 12:01:25 -0500 (EST)

Here are the "Holes" I have commonly found exploitable on systems with
"pine-only" access. They are all pretty easy to fix with conf.fixed,
although some of them will be tricky if you want to give the functionality
intended without exposing yourself...

   alternate editor
   speller
   custom-print command 
   message piping

   All of these (and maybe a couple I have missed) can be used to execute
commands or gain a shell. You also might want to examine your policy on,
since they can aid in (if not allow outright) unauthorized accesses.

   custom headers (especially "From")
   directory access
   changing password from within pine
   allowing any alterations to the .pinerc file at all
   reading in and saving out files

   If you haven't been rooted already by one of these users, you are
extemely lucky. You should definitely consider a re-install, or at least a
thorough comparison with known good copies of all the key system binaries,
and a full scan for anomalous files and directories. (esp. setuid root
executables)

   You should also check your logs (if they haven't been altered or
erased) and find out where these users were coming from. Contacting their
local administrator would be a good idea to help prevent future problems.

-=Jim=- Addy & Associates