Subject: Remote explote for Pine.

From: "John Lange" <[email-masked]>
Date: Tue, 3 Oct 2000 16:55:07 -0500

So what is being done about this?

I have shut down Pine until I can get more info or a patch but my users are
screaming.

John Lange
Darkcore Network

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Jo Knox <[email-masked]>
Date: Tue, 3 Oct 2000 15:52:44 -0800 (AKDT)

> I have shut down Pine until I can get more info or a patch but my users are

If you are referring to OpenBSD Security group putting Pine on their
"forbidden" list, their methodology (as described) is flawed...  If I read
it right, the claim is that since pine uses c functions which can be
exploited by buffer overflows, then a hacker could construct and mail a
message which would have a super long record with executable
payload---that's a huge leap of logic there; one does not necessarily
imply the other!  That not withstanding, it could be possible.  Were that
to be exploited, the message's executed payload could end up with the
privs of the user who invoked Pine.  Seems like the safest course of
action is to forward root's mail somewhere else (doesn't everybody?) and
treat it like other layered software.

Or did I miss something else?

Let's all use Outlook Express!  (And how many days has DOD been shut down
with mail worms?)

jo

---

From: Frank Tobin <[email-masked]>
Date: Tue, 3 Oct 2000 19:44:13 -0500 (CDT)

Jo Knox, at 15:52 -0800 on Tue, 3 Oct 2000, wrote:

> "forbidden" list, their methodology (as described) is flawed...

FreeBSD, not OpenBSD (although maybe them too).

> If I read it right, the claim is that since pine uses c functions
> which can be exploited by buffer overflows, then a hacker could
> construct and mail a message which would have a super long record with
> executable payload---that's a huge leap of logic there; one does not
> necessarily imply the other!

They do not imply each other, but it is cause for very high suspiscion.
Either way, it has more to do with the numerous use of these functions,
and the history of UofW systems.

>  That not withstanding, it could be possible.  Were that to be
> exploited, the message's executed payload could end up with the privs
> of the user who invoked Pine.  Seems like the safest course of action
> is to forward root's mail somewhere else (doesn't everybody?) and

There are two effects that this can bring about.  First, a DOS against the
Pine user.  Second, more serious, a remote attacker could send mail which
could get the user to execute an arbitrary command.

- -- 
Frank Tobin		http://www.uiuc.edu/~ftobin/

---

From: "John Lange" <[email-masked]>
Date: Tue, 3 Oct 2000 20:56:26 -0500

No, I'm referring to the remote exploit of Pine's mail checking routine that
allows a remote user to send mail to a client with a long "FROM" field,
crashing Pine and gaining access to the users account:

http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fvid%3D1709

The scary part is "this can be used for a remote, anonymous attacker to gain
local access to the target host."

Obviously a huge concern. While no exploit has been found in the wild, I
don't want myself or my users to be the first ones to discover one.

I'm wondering if a patch is in the works and how long its expected to take
or do I have to go to the trouble to install a new local mail client
instead? My users obviously can't live without their mail for very long.

The bugtraq advisory was already posted to this list (I read it in the
archives) but here is the jist of it:

--- snip ---
A buffer overflow vulnerability exists in the popular mail client Pine 4.21
(and possibly earlier versions), relating to the function which regularly
checks for incoming email. In standard e-mail message headers is a field
that holds the name and address of the sender. It typically looks like and
is presented in pine like this:

From: username <user@host>

Pine does not check the length of the username value when copying it into a
memory buffer of predefined length. As a result, if a large "from" value is
sent in the email header, it can corrupt "internal" memory when the
offending function is called and the oversized buffer is copied onto the
stack. An attacker can overwrite the return address of the function on the
stack with a value that points back into the buffer, to which the function
would return. Arbitrary machine instructions placed on the stack would then
be executed.

The real concern here is that this requires no user interaction to exploit..
a target need only be using a vulnerable version of pine. The overflow
occurs when the user recieves new email. While typically not yielding root
priviliges (unless root reads email with pine AS root) this can be used for
a remote, anonymous attacker to gain local access to the target host.
--- snip ---

John Lange

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Jo Knox
Sent: Tuesday, October 03, 2000 6:53 PM
To: Pine Discussion Forum
Subject: Re: Remote explote for Pine.

jo

---

From: Lea <[email-masked]>
Date: Wed, 11 Oct 2000 10:12:46 -0600 (MDT)

I accidentally stumbled on a useful feature of Pine, and have now made it
happen twice.  Problem is, I have no idea how I'm doing it, and couldn't
find anything specific in the Pine info pages on the web.  Both times that
it's happened I've been in my INBOX folder and meaning to exit to the
Main menu, I hit some combination of keys that produced a screen titled
'review recent messages'.  The screen showed a summary of how many
messages were marked deleted, new messages that had arrived, and other
useful information - a summary of activity for that particular Pine
session.  How do I reproduce this?  I'd like to use it as a tool. 

Lea