Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.

Pine versions prior to 4.58 are affected by two vulnerabilities discovered by iDEFENSE, a buffer overflow in mailview.c and an integer overflow in strings.c. Both vulnerabilities can result in arbitrary code execution when processing a malicious message.

Pine versions 4.56 and below suffer from a vulnerability which allows an attacker to force the client to execute the attacker's code on the client's system. This issue is easily exploitable since the client will send it's version number by default allowing an attacker to easily identify potential targets.

The remote host is missing the patch for the advisory SUSE-SA:2003:037 (pine).


The well known and widely used mail client pine is vulnerable to a buffer overflow.  The vulnerability exists in the code processing 'message/external-body' type messages. It allows remote attackers to execute arbitrary commands as the user running pine.
Additionally an integer overflow in the MIME header parsing code has been fixed.

Since there is no workaround, an update is strongly recommended for pine users.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated Pine packages that resolve remotely exploitable security issues are now available.

Pine, developed at the University of Washington, is a tool for reading, sending, and managing electronic messages (including mail and news).

A buffer overflow exists in the way unpatched versions of Pine prior to 4.57 handle the 'message/external-body' type. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0720 to this issue.

An integer overflow exists in the Pine MIME header parsing in versions prior to 4.57. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0721 to this issue.

Both of these flaws could be exploited by a remote attacker sending a carefully crafted email to the victim that will execute arbitrary code when the email is opened using Pine.

All users of Pine are advised to upgrade to these erratum packages, which contain a backported security patch correcting these issues.

Red Hat would like to thank iDefense for bringing these issues to our attention and the University of Washington for the patch.

ID	Name	Product	Family	Severity
37712	FreeBSD : pine remotely exploitable vulnerabilities (39bd57e6-5d83-11d8-80e3-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
1326	Pine < 4.58 Multiple Overflows	Nessus Network Monitor	SMTP Clients	high
13805	SUSE-SA:2003:037: pine	Nessus	SuSE Local Security Checks	high
12420	RHEL 2.1 : pine (RHSA-2003:274)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0721

critical

Tenable Plugins

high

high

high

high