Дырка в pine

Редактируемое сообщение помещается во временный файл с предсказуемым именем без проверки разрешений и символьных линков...

mon_pine.sh

Hacksware Bug Report 1. Name: Pine temporary file hijacking vulnerability 2. Release Date: 2000.12.11 3. Affected Application: Pine Version 4.30or maybe other versions 4. Author: [email protected] 5. Type: Local Race Condition 6. Explanation If pine setting is like following: x...

University of Washington Pico 3.x/4.x - File Overwrite

source: https://www.securityfocus.com/bid/2097/info A vulnerability exists in several versions of University of Washington's Pico, a widely-distributed text editor shipped with most versions of Linux / Unix. Under very specific circumstances, it is possible to cause this version of Pico to...

University of Washington Pico 3.x4.x - File Overwrite

University of Washington Pico 3.x4.x - File Overwrite source: https://www.securityfocus.com/bid/2097/info A vulnerability exists in several versions of University of Washington's Pico, a widely-distributed text editor shipped with most versions of Linux / Unix. Under very specific circumstances, ...

buffer overflow vulnerability in Pine

Pine versions 4.21 and before contain a buffer overflow vulnerability which allows a remote user to execute arbitrary code on the local client by the sending of a special-crafted email message. The overflow occurs during the periodic "new mail" checking of an open folder. By upgrading to Pine 4.3...

Ports Security Advisory: FreeBSD-SA-00:59.pine

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:59 Security Advisory FreeBSD, Inc. Topic: pine4 port contains remote vulnerability Category: ports Module: pine4/pine4-ssl/zh-pine4/iw-pine4 Announced: 2000-10-30 Affects...

Переполнение буфера в pine

Классическое переполнение буфера в процедуре периодической проверки почты при длинном заголовке From: письма...

FreeBSD-SA-00:59.pine

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:59 Security Advisory FreeBSD, Inc. Topic: pine4 port contains remote vulnerability Category: ports Module: pine4/pine4-ssl/zh-pine4/iw-pine4 Announced: 2000-10-30 Affects...

pine421.txt

/ PINE Exploit 4.21 bTm Proof of Concept: Pine 4.21 There exists a vulnerability in Pine 4.21 involving the portion of code in charge of peroidically checking email when a pine client is open. Run pine in one window, then send an email to the account owning that session. Switch back over and hit...

UoW Pine 4.0.44.104.21 - From: Remote Buffer Overflow

UoW Pine 4.0.44.104.21 - From: Remote Buffer Overflow // source: https://www.securityfocus.com/bid/1709/info A buffer overflow vulnerability exists in the popular mail client Pine 4.21 and possibly earlier versions, relating to the function which regularly checks for incoming email. In standard...

UoW Pine 4.0.4/4.10/4.21 - 'From:' Remote Buffer Overflow

// source: https://www.securityfocus.com/bid/1709/info A buffer overflow vulnerability exists in the popular mail client Pine 4.21 and possibly earlier versions, relating to the function which regularly checks for incoming email. In standard e-mail message headers is a field that holds the name a...

CVE-2000-0353

Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server, which is then executed by Pine...

CVE-2000-0353

Pine 4.x is affected by CVE-2000-0353. A remote attacker can trigger arbitrary commands by providing an index.html that executes lynx to fetch a uudecoded file from a malicious web server, which is then executed by Pine. Impact is described as full confidentiality, integrity, and availability com...

CVE-2000-0352

Technical details about CVE-2000-0352 are not provided in the connected documents. The initial entry lists the Pine vulnerability but no additional specifics. Monitor for updates.

CVE-2000-0353: Undefined Security Weakness

Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server, which is then executed by Pine...

CVE-2000-0352: Undefined Security Weakness

Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL...

Выполнение команд через pine

К письму может быть прикреплен файл, содержащий скрипт, который будет выполнен с привилегиями пользователя pine...

pine.420.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I reported the vulnerability below to the Pine team on Oct 21, when 4.20 was current. 4.21 which I just noticed on freshmeat seems to fix the problem even though it's not mentioned in the release notes. Since it's not, I thought some disclosure was in...

CVE-2000-0352

Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL...

pinepolicy.txt

Date: Mon, 7 Sep 1998 12:18:28 +0100 From: Chris Wilson Hey people, I've discovered a vulnerability in Pine, tested on version 3.95q, but which probably applies to all versions up to 4.02. This vulnerability allows users to bypass site policies and use Pine to run arbitrary commands in the user's...