cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix denial of service issue with Pine 4.44.

Browse Source 
An attacker can send a fully legal email message with a crafted
From-header and thus forcing pine to core dump on startup.
The only way to launch pine is manually removing the bad message
either directly from the spool, or from another MUA. Until the
message has been removed or edited there is no way of accessing
the INBOX using pine.

http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2
This commit is contained in:
brad 2002-11-25 17:08:37 +00:00
parent b4a58c4b66
commit ec490ee1b5
2 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
mail/pine/Makefile
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.43 2002/02/18 14:43:06 brad Exp $
# $OpenBSD: Makefile,v 1.44 2002/11/25 17:08:37 brad Exp $
COMMENT= "Program for Internet E-mail and News, with pico"
COMMENT-pico= "small text editor"
@ -7,10 +7,9 @@ COMMENT-pine= "Program for Internet E-mail and News, without pico"
VERSION= 4.44
PICO_VERSION= 4.2
DISTNAME= pine${VERSION}
PKGNAME= pine+pico-${VERSION}
PKGNAME= pine+pico-${VERSION}p1
FULLPKGNAME-pico=pico-${PICO_VERSION}
PKGNAME-pine= pine-${VERSION}
NEED_VERSION= 1.500
PKGNAME-pine= pine-${VERSION}p1
MASTER_SITES= ftp://ftp.cac.washington.edu/pine/ \
ftp://ftp.sunet.se/pub/unix/mail/pine/

14
mail/pine/patches/patch-pine_bldaddr_c Normal file
View File

@ -0,0 +1,14 @@
$OpenBSD: patch-pine_bldaddr_c,v 1.1 2002/11/25 17:08:37 brad Exp $
--- pine/bldaddr.c.orig Thu Jun 21 13:53:24 2001
+++ pine/bldaddr.c Mon Nov 25 11:55:38 2002
@@ -7263,8 +7263,8 @@ est_size(a)
for(; a; a = a->next){
/* two times personal for possible quoting */
- cnt += 2 * (a->personal ? strlen(a->personal) : 0);
- cnt += (a->mailbox ? strlen(a->mailbox) : 0);
+ cnt += 2 * (a->personal ? (strlen(a->personal)+1) : 0);
+ cnt += 2 * (a->mailbox ? (strlen(a->mailbox)+1) : 0);
cnt += (a->adl ? strlen(a->adl) : 0);
cnt += (a->host ? strlen(a->host) : 0);