Pine From: Field Heap Corruption Vulnerability

Bugtraq ID:	6120
Class:	Boundary Condition Error
CVE:	CVE-2002-1320
Remote:	Yes
Local:	No
Published:	Nov 07 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Discovery is credited to Linus Sjöberg <[email protected]>.
Vulnerable:	University of Washington Pine 4.44 + EnGarde Secure Linux 1.0.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Linux Advanced Work Station 2.1 + Sun Cobalt Qube 3 + Sun Cobalt RaQ 4 + Sun Cobalt RaQ 550 + Sun Cobalt RaQ XTR + Sun Linux 5.0.7 + Sun Linux 5.0 + SuSE Linux 8.1 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 University of Washington Pine 4.33 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 + HP Secure OS software for Linux 1.0 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 University of Washington Pine 4.30 University of Washington Pine 4.21 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Slackware Linux 7.1 + Slackware Linux 7.0 University of Washington Pine 4.20 + Turbolinux Turbolinux Workstation 6.0 University of Washington Pine 4.10 + Redhat Linux 6.1 sparc + Redhat Linux 6.1 i386 + Redhat Linux 6.1 alpha + Redhat Linux 6.0 sparc + Redhat Linux 6.0 alpha + Redhat Linux 6.0 + SuSE Linux 6.1 alpha + SuSE Linux 6.1 University of Washington Pine 4.2 x University of Washington Pine 4.0.4 + Redhat Linux 5.2 sparc + Redhat Linux 5.2 i386 + Redhat Linux 5.2 alpha University of Washington Pine 4.0.2 University of Washington Pine 4.0 x University of Washington Pine 3.98 + SuSE Linux 5.3
Not Vulnerable:

Pine From: Field Heap Corruption Vulnerability

This vulnerability can be triggered by sending an email message containing a "From:" address similar to the following proof-of-concept example provided by Linus Sjöberg ([email protected]):
"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar

Pine From: Field Heap Corruption Vulnerability

Solution:
It is recommended that all Gentoo Linux users who are running
net-mail/pine-4.44-r5 and earlier update their systems as follows:

emerge rsync
emerge pine
emerge clean

The following fixes are available:


University of Washington Pine 3.98

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.0.2

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.0.4

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.10

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.20

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.21

• Conectiva pico-4.50L-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pico-4.50L-1U70_1cl.i386. rpm


• Conectiva pilot-4.50L-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pilot-4.50L-1U70_1cl.i386 .rpm


• Conectiva pine-4.50L-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pine-4.50L-1U70_1cl.i386. rpm


• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.30

• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.33

• Conectiva pico-4.50L-1U80_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/8/RPMS/pico-4.50L-1U80_1cl.i386.rp m


• Conectiva pilot-4.50L-1U80_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/8/RPMS/pilot-4.50L-1U80_1cl.i386.r pm


• Conectiva pine-4.50L-1U80_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/8/RPMS/pine-4.50L-1U80_1cl.i386.rp m


• MandrakeSoft pine-4.50-1.1mdk.i586.rpm
  Linux-Mandrake 7.2
  http://www.mandrakesecure.net/en/ftp.php


• S.u.S.E. pine-4.33-141.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/pine-4.33-141.ppc.rpm


• S.u.S.E. pine-4.33-143.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/pine-4.33-143.ppc.rpm


• S.u.S.E. pine-4.33-263.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/pine-4.33-263.i386.rpm


• S.u.S.E. pine-4.33-266.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/pine-4.33-266.i386.rpm


• S.u.S.E. pine-4.33-266.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/pine-4.33-266.i386.rpm


• S.u.S.E. pine-4.33-85.alpha.rpm
  ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/pine-4.33-85.alpha.rpm


• S.u.S.E. pine-4.33-97.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/pine-4.33-97.sparc.rpm


• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz

University of Washington Pine 4.44

• EnGarde Secure Linux pine-4.50-1.0.9.i386.rpm
  ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i386/pine-4.50-1 .0.9.i386.rpm


• EnGarde Secure Linux pine-4.50-1.0.9.i686.rpm
  ftp://ftp.engardelinux.org/pub/engarde/stable/updates/i686/pine-4.50-1 .0.9.i686.rpm


• MandrakeSoft pine-4.50-1.1mdk.i586.rpm
  Mandrake Linux 8.0
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft pine-4.50-1.1mdk.i586.rpm
  Mandrake Linux 8.1
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft pine-4.50-1.1mdk.i586.rpm
  Mandrake Linux 8.2
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft pine-4.50-1.1mdk.ia64.rpm
  Mandrake Linux 8.1/IA64
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft pine-4.50-1.1mdk.ppc.rpm
  Mandrake Linux 8.0/PPC
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft pine-4.50-1.1mdk.ppc.rpm
  Mandrake Linux 8.2/PPC
  http://www.mandrakesecure.net/en/ftp.php


• RedHat pine-4.44-1.62.1.i386.rpm
  ftp://updates.redhat.com/6.2/en/os/i386/pine-4.44-1.62.1.i386.rpm


• RedHat pine-4.44-1.70.2.i386.rpm
  ftp://updates.redhat.com/7.0/en/os/i386/pine-4.44-1.70.2.i386.rpm


• RedHat pine-4.44-1.71.1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/pine-4.44-1.71.1.i386.rpm


• RedHat pine-4.44-1.72.2.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/pine-4.44-1.72.2.i386.rpm


• RedHat pine-4.44-1.72.2.ia64.rpm
  ftp://updates.redhat.com/7.2/en/os/ia64/pine-4.44-1.72.2.ia64.rpm


• RedHat pine-4.44-14.80.0.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/pine-4.44-14.80.0.i386.rpm


• RedHat pine-4.44-7.73.0.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/pine-4.44-7.73.0.i386.rpm


• S.u.S.E. pine-4.44-222.i386.patch.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/pine-4.44-222.i386.patc h.rpm


• S.u.S.E. pine-4.44-222.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/pine-4.44-222.i386.rpm


• S.u.S.E. pine-4.44-224.i586.patch.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/pine-4.44-224.i58 6.patch.rpm


• S.u.S.E. pine-4.44-224.i586.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/pine-4.44-224.i58 6.rpm


• Sun 3-All-Security-4.0.1-16306.pkg
  Sun Cobalt Qube3.
  http://ftp.cobalt.sun.com/pub/packages/qube3/ml


• Sun 4-All-Security-2.0.1-16306.pkg
  Sun Cobalt RaQ4.
  http://ftp.cobalt.sun.com/pub/packages/raq4/eng


• Sun 550-All-Security-0.0.1-16306.pkg
  Sun Cobalt RaQ550.
  http://ftp.cobalt.sun.com/pub/packages/raq550/all


• Sun Pine-4.44-1.72.2.i386.rpm
  Sun Linux 5.0.
  ftp://ftp.cobalt.sun.com/pub/products/sunlinux/5.0/en/updates/i386/RPM S/


• Sun XTR-All-Security-1.0.1-16306.pkg
  Sun Cobalt RaQ XTR.
  http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng


• University of Washington Pine 4.50
  ftp://ftp.cac.washington.edu/pine/pine.tar.gz