Subject: hhp: Remote pine exploit. (fwd)

From: Alan Thew <[email-masked]>
Date: Thu, 24 Jun 1999 10:16:31 +0100 (BST)

I've just rejoined the list to get away from the flame fest on
comp.mail.pine (perhaps it's here as well ... ).

This is a "heads up"

Aplogies if you've seen this before.

-- 
Alan Thew                                       [email-masked]
Computing Services,University of Liverpool      Fax: +44 151 794-4442

---------- Forwarded message ----------
Date: Tue, 22 Jun 1999 13:04:14 -0400
From: Elaich Of Hhp <[email-masked]>
To: [email-masked]
Subject: hhp: Remote pine exploit.

                      The hhp presents...

             The hhp-pine remote exploit advisory.
                           6/22/99
                    By: elaich of the hhp.
                     http://hhp.hemp.net/
#---------------------------------------------------------#

   A  few  months  ago  I  found  a bigger problem with the
charset   bug   then  imagined.  With  a  uuencode/uudecode
method  in  the  charset, and an index.html of a site, it's
possible  to run any program/script wanted to on the remote
system.  When  the  email  is read it launches lynx -source
and  grabs  the index.html which is then uudecoded and ran.
This  includes  root and non-root users infected.  Many big
servers run pine, and having fingerd running,  most  of the
time allows us complete access to get every username on the
server, which then is simple to send the infected emails to
each user.
   We have tested this on our own systems with full success.
These  operating systems include BSD, Linux, IRIX, AIX, SCO,
and SunOS.
   I'm  sure  this will be fixed in the newer version along
with  the  patch  already  made  for  the  current version.
hhp-pine.tar   is   available  to  download  at  our  site,
http://hhp.hemp.net/.

   The  current pine 4.10 patch is available to download at
http://www.geek-girl.com/bugtraq/1999_1/0532.html

        Jobs/Probs/Bugs/Etc. -> [email-masked]
#---------------------------------------------------------#

-elaich

-----------------------------------------
elaich of the hhp.            hhp-1999(c)
Email:  [email-masked]
Web:    http://hhp.hemp.net/
Phone:  713-451-6972
hhp-ms: hhp.hemp.net, port:7777, pass:hhp
-----------------------------------------

---

From: Jessica Rasku <[email-masked]>
Date: Thu, 24 Jun 1999 14:50:14 -0700 (PDT)

Can anyone explain this?  I really find ``bug alerts'' that I
don't really understand what is being alerted to be a bit odd.  Maybe I'm
missing something.  This has only twigged a few of the ``hoax'' detectors.
Or, more precicely, it has triggered detectors that say, there is
significant, and important information missing here.  It sounds like not a
problem with Pine itself, but with a combination of Finger setup and
mailcap entries, and other things of this nature, am I totaly confused?  
	I'm not likely to apply a patch that is from a source that I don't
know who they are, especialy when the main site is so obtainable as it is
with Pine.  Shouldn't this have gone though the University of Washington
bug information site first before being announced on Bugtraq?

							Jessica

-- 
Jessica Rasku, Box 270, Rossland, B.C., V0G 1Y0, (250) 362-5701, 
LinuxBox: (250) 362-9668.

List manager: [email-masked] 
     send command help ---- To get help with majordomo
               or lists ---- To get a list of all lists on server.

WWW: <http://www.geocities.com/RainForest/Andes/8749>

---

From: Terry Gray <[email-masked]>
Date: Sat, 26 Jun 1999 09:19:01 -0700 (Pacific Daylight Time)

Please see section 9.2 in http://www.washington.edu/pine/faq/security.html

-teg

---

From: Jessica Rasku <[email-masked]>
Date: Sat, 26 Jun 1999 18:22:21 -0700 (PDT)

> Please see section 9.2 in http://www.washington.edu/pine/faq/security.html

	Thanks, I would say that as I suspected the whole actually is not
with Pine.  At least, based on what is in this document.  The ``alert''
didn't even give as much info as the pine faq.  The faq still lacks the
information to ``manualy'' figure out if it is a potential problem.  I
really would like to see the actuall exploits myself, that would make
testing of other systems much easier.  But, I understand not publishing
this information...

							Jessica