Pine Message/External-Body Type Attribute Buffer Overflow Vulnerability

BID:8588

Info

Pine Message/External-Body Type Attribute Buffer Overflow Vulnerability

Bugtraq ID: 8588
Class: Boundary Condition Error
CVE: CVE-2003-0720
Remote: Yes
Local: No
Published: Sep 10 2003 12:00AM
Updated: Jul 11 2009 11:56PM
Credit: Discovery credited to zen-parse.
Vulnerable: University of Washington Pine 4.56
University of Washington Pine 4.53
University of Washington Pine 4.52
University of Washington Pine 4.50
University of Washington Pine 4.44
+ EnGarde Secure Linux 1.0.1
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux Advanced Work Station 2.1
+ Sun Cobalt Qube 3
+ Sun Cobalt RaQ 4
+ Sun Cobalt RaQ 550
+ Sun Cobalt RaQ XTR
+ Sun Linux 5.0.7
+ Sun Linux 5.0
+ SuSE Linux 8.1
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
University of Washington Pine 4.33
- FreeBSD FreeBSD 4.4
- FreeBSD FreeBSD 4.3
- FreeBSD FreeBSD 4.2
+ HP Secure OS software for Linux 1.0
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
+ SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
University of Washington Pine 4.30
University of Washington Pine 4.21
+ Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Slackware Linux 7.1
+ Slackware Linux 7.0
University of Washington Pine 4.20
+ Turbolinux Turbolinux Workstation 6.0
University of Washington Pine 4.10
+ Redhat Linux 6.1 sparc
 + Redhat Linux 6.1 i386
 + Redhat Linux 6.1 alpha
 + Redhat Linux 6.0 sparc
 + Redhat Linux 6.0 alpha
 + Redhat Linux 6.0
+ SuSE Linux 6.1 alpha
 + SuSE Linux 6.1
University of Washington Pine 4.0.4
+ Redhat Linux 5.2 sparc
 + Redhat Linux 5.2 i386
 + Redhat Linux 5.2 alpha
 University of Washington Pine 4.0.2
University of Washington Pine 3.98
+ SuSE Linux 5.3
SGI ProPack 2.2.1
Not Vulnerable: University of Washington Pine 4.58

Discussion

Pine Message/External-Body Type Attribute Buffer Overflow Vulnerability

A problem in Pine has been reported when handling "message/external body type" attributes. Because of this, an attacker may be able to gain unauthorized access to a host using the vulnerable software.

Solution / Fix

Pine Message/External-Body Type Attribute Buffer Overflow Vulnerability

Solution:
This issue has been resolved in Pine 4.58.

Gentoo has released an advisory (200309-10) to address this issue. Affected users are advised to run the following commands to upgrade their pine installation:
emerge sync
emerge pine
emerge clean

Red Hat has released a security advisory (RHSA-2003:273-01) and fixes for this issue. Links to fixed packages may be found in the referenced advisory.

S.u.S.E. has released an advisory (SuSE-SA:2003:037) and fixes for this issue. Links to the fixed packages may be found in the referenced advisory.

Slackware has released an advisory (SSA:2003-253-01) and fixes for this issue. Links to the fixed packages may be found in the referenced advisory.

Guardian Digital has released advisory ESA-20030911-022 with fixes to address this issue. See referenced advisory for additional details.

Conectiva has released advisory CLSA-2003:738 to address this issue.

TurboLinux has released a security advisory (TLSA-2003-57), including fixes to address this issue. Users are advised to upgrade the appropriate packages as soon as possible.

Sun have released fixes to address this issue in Sun Linux 5.0.7. Users
who are affected by this issue are advised to apply relevant fixes as soon
as possible. Please see Sun reference (Sun Linux Support - Sun Linux
Patches (Sun)) for further details regarding obtaining and applying
appropriate fixes.

Red Hat has released advisory RHSA-2003:274-05 to address this issue in their Linux Enterprise software. Relevant patches are available through the Red Hat Network. See the referenced advisory for additional details.

SGI has released an advisory (20031002-01-U) pertaining to their ProPack Linux distribution. The advisory has been released in response to a number of RHSA advisories, and includes a patch (Patch 10027) containing updated RPM packages relating to 22 different BIDS.

Patch 10027 can be obtained via the following link:
http://support.sgi.com/

For information regarding how to obtain individual RPM packages included in Patch 10027, please see the attached advisory.

Sun has released an upgrade for this issue for their Cobalt product line.


University of Washington Pine 3.98

University of Washington Pine 4.0.2

University of Washington Pine 4.0.4

University of Washington Pine 4.10

University of Washington Pine 4.20

University of Washington Pine 4.21

University of Washington Pine 4.30

University of Washington Pine 4.33

University of Washington Pine 4.44

University of Washington Pine 4.50

University of Washington Pine 4.52

University of Washington Pine 4.53

University of Washington Pine 4.56

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report