CVE-2000-0352

Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL...

pine4.10-remote.txt

Date: Mon, 8 Feb 1999 00:22:17 +0100 From: Michal Zalewski To: [email protected] Subject: remote exploit on pine 4.10 - neverending story? Affected systems: ----------------- Any Unx system running 'pine' up to version 4.10 latest. Compromise: ----------- Remote execution of arbitrary code whe...

pine.4.xx.lockfile.txt

Date: Sun, 5 Mar 1999 01:41:25 +0100 From: Michal Zalewski Lockfile vunerability in pine 4.xx Linux The problem is probably well known, but silently ignored by pine vendors. Unfortunately, it's possible to turn 'mostly harmless feature' in something nasty - following code allows various DoSes by...