Subject: Pine 4.44 now available

From: Steve Hubert <[email-masked]>
Date: Wed, 9 Jan 2002 15:50:31 -0800 (Pacific Standard Time)

This note is to announce the availability of the Pine Message System
version 4.44. The purpose of this release is to fix a security
bug with the treatment of quotes in the URL-handling code. The bug
allows a malicious sender to embed commands in a URL. This bug is
present in all versions of UNIX Pine. There is no vulnerability from
this bug in PC-Pine.

The release notes are available from within Pine ("R" command off the
Main Menu) and via

        http://www.washington.edu/pine/changes.html
and
        ftp://ftp.cac.washington.edu/pine/docs/

Source for the latest Pine release is available in:

        ftp://ftp.cac.washington.edu/pine/pine.tar.Z
and
        ftp://ftp.cac.washington.edu/pine/pine.tar.gz

Precompiled binaries for the various systems we have direct access to
are available in:

        ftp://ftp.cac.washington.edu/pine/unix-bin
and
        ftp://ftp.cac.washington.edu/pine/unix-bin-compressed

The corresponding PC-Pine distribution is available in:

        ftp://ftp.cac.washington.edu/pine/pcpine/pm444w32.zip

As with all Pine releases, it is important that you carefully test and
determine for yourself that it performs suitably in your environment
before placing Pine into production use.

The Pine Development Team

-- 
-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------
-- 
-------------------------------------------------------------
 For information about this mailing list, see: 
 http://www.washington.edu/pine/pine-info/pine-announce.html
-------------------------------------------------------------

---

From: Kenneth Crudup <[email-masked]>
Date: Wed, 9 Jan 2002 16:28:14 -0800 (PST)

On Wed, 9 Jan 2002, Steve Hubert wrote:

> The purpose of this release is to fix a security

Can you explain? The URL I get is passed to a script that changes commas
into "%2D"s then runs that past nutscrape. I can't see how someone could
get into my box that way.

	-Kenny

-- 
Kenneth R. Crudup   Sr. SW Engineer, Scott County Consulting, Washington, D.C.
Home1: PO Box 914         Silver Spring, MD 20910-0914         [email-masked]
Home2: 38010 Village Cmn. #217  Fremont, CA 94536-7525          (510) 745-0101

---

From: Eduardo Chappa <[email-masked]>
Date: Wed, 9 Jan 2002 19:57:21 -0800 (PST)

*** Kenneth Crudup ([email-masked]) wrote today:

> Can you explain? The URL I get is passed to a script that changes
> commas into "%2D"s then runs that past nutscrape. I can't see how
> someone could get into my box that way.
>

Read the following thread in Bugtraq:

http://groups.google.com/groups?selm=bugtraq/Pine.LNX.4.33.0201051514170.25654-100000%40clarity.local

I am still unable to reproduce what it says there, even when I copied and
pasted the html code, and created an html e-mail with it. I don't see the
exploit. It may be shell or system dependent, but I can confidently say
that no one can exploit this ``bug'' in my system.

-- 
Eduardo
http://www.math.washington.edu/~chappa/pine/

---

From: Steve Hubert <[email-masked]>
Date: Wed, 9 Jan 2002 23:39:20 -0800 (PST)

If the url looks like

    http://domain';command'

I think you'll get command executed. The IFS stuff will only work if you
have SHELL=/bin/sh or similar in your environment, I think. The example I
saw had an ampersand in place of the semicolon, which doesn't work for me.

Steve

---

From: Eduardo Chappa <[email-masked]>
Date: Thu, 10 Jan 2002 19:50:19 -0800 (PST)

*** Steve Hubert ([email-masked]) wrote in the pine-info list on Jan...:

:) If the url looks like
:)
:)     http://domain';command'
:)
:) I think you'll get command executed. The IFS stuff will only work if you
:) have SHELL=/bin/sh or similar in your environment, I think. The example I
:) saw had an ampersand in place of the semicolon, which doesn't work for me.

That's what I tried too, but wouldn't work here. I think the IFS stuff was
meant to make it write spaces. I tried this in a linux machine that I
could get access to, and the ';command' would get executed, but only if it
did not contain a space, so something like http://www';xv' would be
executed but not http://www';xv picture.gif', because of the space, as you
can see. Quite harmless, I think.

I also noticed that Pine would not expand shell variables in URLs as it
did before, that's a good change, I think.

---

From: "Scott Mohnkern" <[email-masked]>
Date: Mon, 14 Jan 2002 15:47:06 -0500

I'm running Solaris, version 5.6, instead of 5.8, and when I try to run the 5.8 binary I get

ld.so.1: ./pine-bin.sun58: fatal: libcurses.so.1: open failed: No such file or directory
Killed

Does someone have a 5.6 binary, or is there a way to fix this?

Scott

Scott Mohnkern
[email-masked]