• info
• discussion
• exploit
• solution
• references

Pine Environment Variable URL Shell Interpreting Vulnerability

Solution:
HP Secure OS software for Linux 1.0 users should download and apply the Red Hat RPMs.

Vendor fixes available:


University of Washington Pine 4.20

• University of Washington Pine 4.44
  ftp://ftp.cac.washington.edu/pine/pine.tar.Z

University of Washington Pine 4.21

• Conectiva pico-4.44L-1U50_1cl.i386.rpm
  Release 5.0
  ftp://atualizacoes.conectiva.com.br/5.0/i386/pico-4.44L-1U50_1cl.i386. rpm


• Conectiva pico-4.44L-1U50_1cl.i386.rpm
  ECommerce Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/pico-4. 44L-1U50_1cl.i386.rpm


• Conectiva pico-4.44L-1U50_1cl.i386.rpm
  Graficas Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/pico-4.4 4L-1U50_1cl.i386.rpm


• Conectiva pico-4.44L-1U51_1cl.i386.rpm
  Release 5.1
  ftp://atualizacoes.conectiva.com.br/5.1/i386/pico-4.44L-1U51_1cl.i386. rpm


• Conectiva pico-4.44L-1U70_1cl.i386.rpm
  Release 7.0
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pico-4.44L-1U70_1cl.i386. rpm


• Conectiva pilot-4.44L-1U50_1cl.i386.rpm
  Release 5.0
  ftp://atualizacoes.conectiva.com.br/5.0/i386/pilot-4.44L-1U50_1cl.i386 .rpm


• Conectiva pilot-4.44L-1U50_1cl.i386.rpm
  ECommerce Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/pilot-4 .44L-1U50_1cl.i386.rpm


• Conectiva pilot-4.44L-1U50_1cl.i386.rpm
  Graficas Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/pilot-4. 44L-1U50_1cl.i386.rpm


• Conectiva pilot-4.44L-1U51_1cl.i386.rpm
  Release 5.1
  ftp://atualizacoes.conectiva.com.br/5.1/i386/pilot-4.44L-1U51_1cl.i386 .rpm


• Conectiva pilot-4.44L-1U70_1cl.i386.rpm
  Release 7.0
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pilot-4.44L-1U70_1cl.i386 .rpm


• Conectiva pine-4.44L-1U50_1cl.i386.rpm
  Release 5.0
  ftp://atualizacoes.conectiva.com.br/5.0/i386/pine-4.44L-1U50_1cl.i386. rpm


• Conectiva pine-4.44L-1U50_1cl.i386.rpm
  ECommerce Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/pine-4. 44L-1U50_1cl.i386.rpm


• Conectiva pine-4.44L-1U50_1cl.i386.rpm
  Graficas Release
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/pine-4.4 4L-1U50_1cl.i386.rpm


• Conectiva pine-4.44L-1U51_1cl.i386.rpm
  Release 5.1
  ftp://atualizacoes.conectiva.com.br/5.1/i386/pine-4.44L-1U51_1cl.i386. rpm


• Conectiva pine-4.44L-1U70_1cl.i386.rpm
  Release 7.0
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/pine-4.44L-1U70_1cl.i386. rpm


• Red Hat pine-4.44-1.62.0.alpha.rpm
  Release 6.2
  ftp://updates.redhat.com/6.2/en/os/alpha/pine-4.44-1.62.0.alpha.rpm


• Red Hat pine-4.44-1.62.0.i386.rpm
  Release 6.2
  ftp://updates.redhat.com/6.2/en/os/i386/pine-4.44-1.62.0.i386.rpm


• Red Hat pine-4.44-1.62.0.sparc.rpm
  Release 6.2
  ftp://updates.redhat.com/6.2/en/os/sparc/pine-4.44-1.62.0.sparc.rpm


• Red Hat pine-4.44-1.70.0.alpha.rpm
  Release 7.0
  ftp://updates.redhat.com/7.0/en/os/alpha/pine-4.44-1.70.0.alpha.rpm


• Red Hat pine-4.44-1.70.0.i386.rpm
  Release 7.0
  ftp://updates.redhat.com/7.0/en/os/i386/pine-4.44-1.70.0.i386.rpm


• University of Washington Pine 4.44
  ftp://ftp.cac.washington.edu/pine/pine.tar.Z

University of Washington Pine 4.30

• University of Washington Pine 4.44
  ftp://ftp.cac.washington.edu/pine/pine.tar.Z

University of Washington Pine 4.33

• FreeBSD ports-4 pine-4.44.tgz
  ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/pi ne-4.44.tgz


• Red Hat pine-4.44-1.71.0.alpha.rpm
  Release 7.1
  ftp://updates.redhat.com/7.1/en/os/alpha/pine-4.44-1.71.0.alpha.rpm


• Red Hat pine-4.44-1.71.0.i386.rpm
  Release 7.1
  ftp://updates.redhat.com/7.1/en/os/i386/pine-4.44-1.71.0.i386.rpm


• Red Hat pine-4.44-1.71.0.ia64.rpm
  Release 7.1
  ftp://updates.redhat.com/7.1/en/os/ia64/pine-4.44-1.71.0.ia64.rpm


• Red Hat pine-4.44-1.72.0.i386.rpm
  Release 7.2
  ftp://updates.redhat.com/7.2/en/os/i386/pine-4.44-1.72.0.i386.rpm


• Red Hat pine-4.44-1.72.0.ia64.rpm
  Release 7.2
  ftp://updates.redhat.com/7.2/en/os/ia64/pine-4.44-1.72.0.ia64.rpm


• Red Hat pine-4.44-1.72.0.s390.rpm
  S/390
  ftp://updates.redhat.com/7.2/en/os/s390/pine-4.44-1.72.0.s390.rpm


• University of Washington Pine 4.44
  ftp://ftp.cac.washington.edu/pine/pine.tar.Z