Subject: possible bug

From: "Brent Sodtke" <[email-masked]>
Date: Thu, 17 Feb 2005 10:29:23 -0500

Hi,

We are using version 4.62 and have stumbled across a method to possibly spoof the "from" address and was wondering if anyone had any ideas on how to close this hole.

A little background. Pine users have a read-only pinerc file in a multi-user environment so no one can make changes to the config affecting other users. Within the pinerc file, we have the following set:

user-id=""
quell-user-id-prompt

With these options, a user initially is prompted to login. If they don't and just press "enter", they get "login aborted." which is normal and accepted. If after not logging in, the user goes to "compose" from the main menu, they are prompted to login again. If doing so successfully, they are then presented with entering their "user-id" which is being used as their "from" address. So conceivably I can put any return address here and upon successful send of the msg, the recipient shows the from address as the user-id entered above, and not the true logged in address. I'm sure you can see the problem.

Are there some settings that I'm missing or is there another method of preventing this?

BTW, the X-X-Sender header info is shown as the original logged in account, but how many recipients actually check this! :) Also, changing the "user-id" setting in the config file makes ALL email regardless of login name appear as from the "user-id" setting. Clearly unacceptable in a multi-user environment.

Thank you,
Brent.

---

From: Eduardo Chappa <[email-masked]>
Date: Thu, 17 Feb 2005 07:49:28 -0800 (PST)

*** Brent Sodtke ([email-masked]) wrote in the pine-info...:

:) Within the pinerc file, we have the following set:
:) 
:) user-id=""
:) quell-user-id-prompt
:) [deleted some text]
:) So conceivably I can put any return address here and upon successful 
:) send of the msg, the recipient shows the from address as the user-id 
:) entered above, and not the true logged in address. I'm sure you can see 
:) the problem.

Brent,

If this were unix, I would try defining user-id=$LOGNAME. The main idea is 
to use an environment variable that contains the name of the user logged 
in. I am sure you can do something equivalent in any platform too.

I would also add no-allow-changing-from to the pinerc file.

-- 
Eduardo
Patches/Help: http://www.math.washington.edu/~chappa/pine/
XML/RSS feed: http://www.math.washington.edu/~chappa/pine/pine.xml
Please send spam to webmaster@localhost