Subject: THIS IS A BUG

From: Iztok Polanic <[email-masked]>
Date: Mon, 16 Nov 1998 20:12:48 +0100 (MET)

Hello !!!

I don't know if this exists in new realeses of Pine, but I do know that
this works in 3.96 versions. 
I found this bug on the web.
----------
 Hello Everyone. I would like to announce that I have discovered what
appears
to be a rather serious bug in the Pine Mail Client, that allows a user of
Pine to overwrite ANY file, with ANY permissions or ownerships in their
home
directory (including sub-directorys).

 This bug can be used to overwrite a protected login script, or to
overwrite
a resource file (like .pinerc). This can be of serious concern to those
that
use Pine as a shell for users, as this can allow them to modify or create
files that could be used to gain shell access. (Such as .rhosts, .forward,
etc.)

 All that is required to exploit this apparent bug is to open up a message
attachment using the Pine attachment viewer, and save the attachment.
 If you want to overwrite ANY file anywhere in the users home directory,
just enter the file name and select overwrite. This does not work outside
of the users home directory BTW.

 The interesting thing about this is that it appears to completly bypass
any
filesystem level security (permissions, owner, etc.). Also, when pine
overwrites the file it sets the mode to 622 (-rw-r--r--) and the owner to
the current user. (The pine executable IS NOT setuid root.)

 I have verified this behavior on Pine version 3.95 & 3.96 on Linux
systems.
So far I have not been able to find a version or system that is not
susceptable.

 I do not currently know of any patch or fix for this behavior.
----------------------

If this is still not fix, then please FIX IT!

								Bye. 

                                          //////
      xxxxxx                             ( o o )
      xx  xx           /------------oOO-----O-----OOo------------\
      xx  xx           |           From: Iztok Polanic           |
       xxxx            |  E-mail: [email-masked]  |
      xx  xx           |      WWW: http://kotzi.home.ml.org      |
     xx    xx          |            http://www.intering.si       |
    xx      xx         |           ICQ: Kotzi => *12556824*      |
                       \-----------------------------------------/

-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Jeff <[email-masked]>
Date: Mon, 16 Nov 1998 15:32:32 -0600 (CST)

> Hello !!!

Greetings,

> ----------
> Hello Everyone. I would like to announce that I have discovered
> what appears to be a rather serious bug in the Pine Mail Client,
> that allows a user of Pine to overwrite ANY file, with ANY
> permissions or ownerships in their home directory (including
> sub-directorys). 

<snip>

Because you own your home directory.
Try saving a file to a subdirectory that isn't owned by you.

> The interesting thing about this is that it appears to completly
> bypass any filesystem level security (permissions, owner, etc.).
> Also, when pine overwrites the file it sets the mode to 622
> (-rw-r--r--) and the owner to the current user. (The pine executable
> IS NOT setuid root.)

It sets the mode to your current umask, at least according to my
experiments.  Also see above.

> systems.  So far I have not been able to find a version or system
> that is not susceptable. I do not currently know of any patch or
> fix for this behavior.

Because it's the default behavior on unix systems.

You might look into a shorter .sig as well :)

-jeff
-----
Jeff Schaller                   [email-masked]
UNIX System Administrator       Phone:  (316) 946-7255
Learjet Inc                     Fax:    (316) 946-2809
 3:31pm up 4 days, 4:31, 9 users, load average: 0.16, 0.16, 0.14
(speaking for himself, working at Learjet)

---

From: Jim Sander <[email-masked]>
Date: Mon, 16 Nov 1998 17:01:45 -0500 (EST)

Not a bug in pine. That's just the way the Unix file system works, for
better or for worse. Don't believe me? Try this...

su
touch ~user/deleteme
chmod 000 ~user/deleteme
now go back to being "user"

ls -l deleteme
  ----------  1 root  wheel  0 Nov 16 16:16 deleteme

rm deleteme
  override ---------  root/wheel for deleteme? 
  (answer y and the file is gone)

   Ak! The shell is broken- fix it! :) I know this doesn't explain
everything- but this list is about pine, not Unix in general. You should
probably read up on the way Unix handles file hierarchy, and man chmod.
There's probably a way to accomplish what you want, but "fixing" this in
pine won't do any good. When you "man chmod" pay close attention to the
part on sticky bits and see if it's any help.

-=Jim=-

P.S. Once you understand all of this, the issue of overwriting files will
     be immediately revealed. (hint: you're probably using a copy of the
     file you're editing)