Subject: PINE format string vulnerabilities

From: "Mike A. Harris" <[email-masked]>
Date: Fri, 13 Oct 2000 18:22:31 -0400 (EDT)

Recently on BUGTRAQ someone posted a security audit on PINE
showing that it had over 4000 format string vulnerabilities.  
Being an avid PINE user, I was shocked.  I do not know the
legitimacy of this claim yet, however I wanted to ask here to get
the official response.

It was suggested on BUGTRAQ that it would be worthless to try and
fix PINE with that many bugs.  I disagree completely however as
grep/sed/perl are our friends, and this is open source.

Therefore, has the PINE team an official position on PINE format
string vulnerabilities?  Is anyone correcting any such
bugs?  Does the PINE team need help doing so?  I would be
interested in trying to help correct format string bugs if the
effort wouldn't be duplicated, and I could be assigned certain
portions of code to audit.

Thanks in advance.

----------------------------------------------------------------------
      Mike A. Harris  -  Linux advocate  -  Open source advocate
              Computer Consultant - Capslock Consulting
                 Copyright 2000 all rights reserved
----------------------------------------------------------------------

"A Firewall is really much like a sophisticated traffic cop; it detects and
stops unauthorized or suspicious movement in or out of the network. But
security is more than a Firewall; it's a process. You can't just put in a
Firewall and think you're secure."

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: "John Lange" <[email-masked]>
Date: Wed, 18 Oct 2000 15:41:53 -0500

I have no idea what the offical response is and postings to this list on
this topic are pretty much ignored. It seems like there isn't a pine
development team anymore or if there is, they don't read this list.

Furthermore, their web site has not been updated recently. So I'm wondering
if anyone is maintaining Pine anymore?

John Lange

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Mike A. Harris
Sent: Friday, October 13, 2000 5:23 PM
To: Pine Discussion Forum
Subject: PINE format string vulnerabilities

Thanks in advance.

---

From: "Aaron S. Hawley" <[email-masked]>
Date: Wed, 18 Oct 2000 16:51:52 -0400 (EDT)

On Wed, 18 Oct 2000, John Lange wrote:

> I have no idea what the offical response is and postings to this list
> on this topic are pretty much ignored. It seems like there isn't a
> pine development team anymore or if there is, they don't read this
> list.
> 

from what i've observed, they try to spend their time developing rather
than discussion on lists, or updating the web pages, unless a new version
is released.  they occasionally pop up in a newsgroup or in this list if
people make enough inflammatory comments about their "lil' pride and joy"

version 4.3x or something should be on the way.  we might just have
offline use (w/out hacking a pine config file).

aaron

---

From: Scott Leibrand <[email-masked]>
Date: Wed, 18 Oct 2000 14:51:58 -0700 (PDT)

> offline use (w/out hacking a pine config file).

No disconnected support this time around.  They say the next release with
new features should have it.  Here's a pared-down excerpt of the release
notes for pre-release 4, with my comments in parentheses:

Major new additions include:

 *  Configuration flexibility
     +  pine configurations can now be stored remotely on an imap server
	for access from different locations without the need to configure
	for each location.
     +  configuration may be split into two parts: generic configuration
	and exceptional, per-platform configuration.
     +  signatures can now be stored remotely or as part of the pinerc
	file
     +  for configuration options which are lists, inheritance is
	supported
 *  New security features (SSL support, etc.)
 *  Minor rule enhancements
 *  Enhanced MAPI support for PC-Pine
 *  Various other new features and configuration options
 *  New command line options (for remote IMAP config file support)

Someone please yell at me if I'm not supposed to be telling people all
this.  :)

-- 
Scott Leibrand
[email-masked]            (Yes, that is a valid address.)
http://students.washington.edu/leibrand
* RCW 19.190 notice: This email address is located in Washington State. *
* Unsolicited commercial email may be billed $500 per message.          *

---

From: Scott Leibrand <[email-masked]>
Date: Wed, 18 Oct 2000 16:20:43 -0700 (PDT)

On Wed, 18 Oct 2000, Scott Leibrand wrote:

> new features should have it.

Clarification:  That's when we (Pine power users like myself) HOPE it will
be available.  As usual, the Pine team (which doesn't include me) makes no
promises about when new features like this one (which IS on the
future-features list) might be added.

---

From: "Mike A. Harris" <[email-masked]>
Date: Wed, 18 Oct 2000 20:45:44 -0400 (EDT)

>people make enough inflammatory comments about their "lil' pride and joy"

Well, I am a complete total die hard PINE user, so..  ;o)
I've got my complaints too, but _NOTHING_ will stop me from using
PINE short of a bullet in the head.

>offline use (w/out hacking a pine config file).

Cool, so the number of format string bugs will be even higher
soon!  I can't wait!  ;o)

Want to try a new high performance open source web server?  Try Caudium!
http://caudium.org            http://caudium.sourceforge.net

---

From: Steve Hubert <[email-masked]>
Date: Thu, 19 Oct 2000 12:17:05 -0700 (PDT)

We still exist and we read the list. We're not very good at coming up with
official responses. The newmail check buffer overflow bug will be fixed in
Pine 4.30. We are trying to get 4.30 out as soon as we can. We are almost
always overly optimistic when we predict release dates so we don't predict
release dates publicly anymore. But what the heck, probably next week.

There will still be 3 or 4000 possible format string vulnerabilities so we
would guess that we'll remain on the forbidden list. I suppose if we
changed calls like

   strcpy(buf, "xyz")  into
   strncpy(buf, "xyz", buflen)

they would take us off the list. Maybe we'll do that some day.

-- 
Steve Hubert <[email-masked]>
Networks and Distributed Computing, Univ. of Washington, Seattle

---

From: Frank Tobin <[email-masked]>
Date: Thu, 19 Oct 2000 15:28:35 -0500 (CDT)

Steve Hubert, at 12:17 -0700 on Thu, 19 Oct 2000, wrote:

> I suppose if we changed calls like
> 
>    strcpy(buf, "xyz")  into

They would likely take you off the list if you did.  The multitude of
these un-n'd str* calls appears to be the overriding, but not only, factor
in the decision.

Ran: Isn't C just awful with strings? :)

-- 
Frank Tobin		http://www.uiuc.edu/~ftobin/

---

From: Dan Peterson <[email-masked]>
Date: Thu, 19 Oct 2000 16:45:41 -0400 (Eastern Daylight Time)

>  *  Minor rule enhancements

Any chance these "Minor rule enhancements" would include some Role
handling... specifically, supporting ^P and ^N to select a Role?

I believe I wasn't the only one that wanted that particular feature added
back in. ;-)

On Mon, 18 Oct 1999, Scott Leibrand wrote:

> [...]
>
> - What happened to ^P and ^N in the Roles Selection screen?  Now it's
> a two-step process to choose an alternate role, where before it was
> only one.

---

From: Leslie Fairall <[email-masked]>
Date: Fri, 20 Oct 2000 11:17:24 -0400 (EDT)

Why is pine on a forbidden list? What list is this?

***** **************************************************
"Contrary to popular belief, Unix is user friendly. It's just very
particular about who it makes friends with."
mailto:[email-masked]

---

From: Michael Urban <[email-masked]>
Date: Fri, 20 Oct 2000 10:42:27 -0500

Pine is currently on the forbidden list in the FreeBSD ports
collection because of a buffer overflow bug in the From field. In a
nutshell, a very long from header will overflow a buffer in Pine,
causing it to crash. The problem with this is that a when the buffer
overflows, it can allow the attacker to execute arbitrary code on
your system. All he has to do is send a malicious email message that
overflows Pine's buffer.

This is, unfortunatly, only one of many thousands of potential
vulnerabilites in Pine, so I doubt that fixing this one problem will
get it off the forbidden list.

I would like to see Pine fixed since I really like Pine. However,
right now, I am using Mutt just to be safe.

A potential way around this problem pending fixing of Pine is to have
an MDA such as procmail filter messages with malicious headers
prior to delivery.

---

From: Henrik Edlund <[email-masked]>
Date: Fri, 20 Oct 2000 18:36:43 +0200 (CEST)

> an MDA such as procmail filter messages with malicious headers

Do you have a good procmail rule to kill mails with too long (for
Pine) header lines?

TIA, Henrik

-- 
Henrik Edlund (HE2914-RIPE)
http://www.edlund.org/

"Never implement limitations."
        -- Henrik Edlund

---

From: Michael Urban <[email-masked]>
Date: Fri, 20 Oct 2000 11:54:29 -0500

Unfortunately, I don't. But I can point you to a web resource that I
think will probably be very helpful. I haven't actually read most of
this web site, but it does look like it addresses the issue.

http://www.impsec.org/email-tools/procmail-security.html

Hope that URL helps you out some.

---

From: Michael Urban <[email-masked]>
Date: Fri, 20 Oct 2000 11:58:43 -0500

Oh. Something else I should mention just to make sure there is no
misunderstanding.

These bugs are not limitted to FreeBSD. They affect Pine running on
all platforms. FreeBSD just does a reasonably good job of warning
their users about bugs in applications and not just the OS itself.