Subject: So-called "remote exploit in pine" (fwd)

From: Terry Gray <[email-masked]>
Date: Thu, 11 Feb 1999 13:38:23 -0800 (Pacific Standard Time)

fyi

-teg

---------- Forwarded message ----------
Date: Wed, 10 Feb 1999 18:21:11 -0800 (Pacific Standard Time)
From: Pine Development Team <[email-masked]>
To: [email-masked]
Organization: University of Washington;  Computing & Communications
Subject: So-called "remote exploit in pine"

Many of you have inquired about a recent widely-distributed message
describing a "remote exploit in pine", specifically, a "vunerability in
metamail package used with pine" and a claim that the '`' character "is
incorrectly expanded by pine".

We believe the following to be true:

 o There is indeed a vulnerability in the default *mailcap* file
   distributed with the popular metamail MIME-support package.   

 o This same mailcap file has in the past been included in Pine
   distributions as a sample; however, this sample file is not used by
   Pine unless it is manually installed and renamed.

 o While the metamail package *can* be used with Pine, Pine does not
   *require* the installation of metamail.

 o If a site chooses to install metamail, they should definitely expunge
   the dangerous entries from the default mailcap file.  Such a corrected 
   mailcap file is attached.

 o If correcting the system mailcap file is not immediately possible,
   users may wish to set Pine's "mailcap-search-path" variable to a
   personal mailcap file path.  (See Pine's Main/Setup/Config screen.)

 o Everyone should beware of offered workarounds in the form of Pine
   patches that simply insert the shell-escape character before any
   substituted back-quotes, as this only results in moving the problem
   down one level of shell-nesting.

 o PC-Pine users are not vulnerable to these dangerous mailcap entries.

We do not agree that the '`' character "is incorrectly expanded by pine".
Rather, we believe that Pine correctly implements RFC-1524.  However, it
is possible to modify Pine to preclude mailcap parameter substitution and
thereby avoid mailcap risks at sites where faulty mailcap files may be
installed.  A patch to do this is attached.  Obviously, this patch will
also break any legitimate mailcap entries that depend on parameter
substitution.

While one could modify Pine to guard against the particular exploit
permitted by the mailcap entries in question, it is very difficult to
conceive of a truly safe "paranoid mode" other than disabling parameter
substitution entirely.  However, we suspect most people will find it far
easier to remove any unsafe entries from their mailcap configuration file.

Sincerely,

 Pine Development Team
  University of Washington
*** ./pine/init.c.orig	Tue Jan 26 11:57:56 1999
--- ./pine/init.c	Tue Feb  9 19:23:06 1999
***************
*** 1791,1796 ****
--- 1791,1798 ----
  	 F_QUELL_PARTIAL_FETCH, NO_HELP, PREF_NONE},
  	{"save-aggregates-copy-sequence",
  	 F_AGG_SEQ_COPY, NO_HELP, PREF_NONE},
+ 	{"enable-mailcap-param-substitution",
+ 	 F_DO_MAILCAP_PARAM_SUBST, NO_HELP, PREF_NONE},
  	{"termdef-takes-precedence",
  	 F_TCAP_WINS, NO_HELP, PREF_NONE}
      };
*** ./pine/mailcap.c.orig	Wed Nov 18 10:00:15 1998
--- ./pine/mailcap.c	Tue Feb  9 19:23:40 1999
***************
*** 739,745 ****
      dprint(5, (debugfile, "- mc_passes_test -\n"));
  
      if(mc->testcommand && *mc->testcommand)
! 	cmd = mc_bld_test_cmd(mc->testcommand, type, subtype, params);
      
      if(!mc->testcommand || !cmd || !*cmd){
  	if(cmd)
--- 739,746 ----
      dprint(5, (debugfile, "- mc_passes_test -\n"));
  
      if(mc->testcommand && *mc->testcommand)
! 	if(!(cmd = mc_bld_test_cmd(mc->testcommand, type, subtype, params)))
! 	  return(FALSE);	/* couldn't be built */
      
      if(!mc->testcommand || !cmd || !*cmd){
  	if(cmd)
***************
*** 794,800 ****
      if(needsterm)
        *needsterm = mc->needsterminal;
  
!     command = mc_cmd_bldr(mc->command, type, subtype, params, tmp_file);
  
      dprint(5, (debugfile, "built command: %s\n", command));
  
--- 795,802 ----
      if(needsterm)
        *needsterm = mc->needsterminal;
  
!     if(!(command = mc_cmd_bldr(mc->command, type, subtype, params, tmp_file)))
!       command = cpystr("");
  
      dprint(5, (debugfile, "built command: %s\n", command));
  
***************
*** 871,876 ****
--- 873,884 ----
  		break;
  
  	      case '{':			/* insert requested MIME param */
+ 		if(F_OFF(F_DO_MAILCAP_PARAM_SUBST, ps_global)){
+ 		    dprint(2,
+ 			   (debugfile, "mc_cmd_bldr: param subs %s\n", from));
+ 		   return(NULL);
+ 		}
+ 
  		s = strindex(from, '}');
  		if(!s){
  		    q_status_message1(SM_ORDER, 0, 4,
***************
*** 956,962 ****
        sprintf(to, MC_ADD_TMP, tmp_file);
  
      return(cpystr(tmp_20k_buf));
! } 

  /*
--- 964,970 ----
        sprintf(to, MC_ADD_TMP, tmp_file);
  
      return(cpystr(tmp_20k_buf));
! }

  /*
*** ./pine/pine.h.orig	Thu Jan 28 16:52:00 1999
--- ./pine/pine.h	Tue Feb  9 19:23:21 1999
***************
*** 886,891 ****
--- 886,892 ----
  	F_SHOW_TEXTPLAIN_INT,
  	F_ROLE_CONFIRM_DEFAULT,
  	F_NO_FCC_ATTACH,
+ 	F_DO_MAILCAP_PARAM_SUBST,
  #ifdef	ENABLE_LDAP
  	F_ADD_LDAP_TO_ABOOK,
  #endif