Executive brief
Pine, a popular email client for Unix-based systems, contains a security flaw in how it handles temporary files. A local user on the same system can exploit this to gain the privileges of another user, potentially leading to unauthorized access to private files or account takeover. This issue is particularly relevant for shared computing environments where multiple users log into the same server.
Technical details
A symbolic link vulnerability exists in Pine's mail handling logic. When a user receives new mail, Pine creates a lockfile in the /tmp directory using a predictable naming convention (e.g., .[pid].[hex]). Because these files are created with world-writable permissions (mode 666) and the names are guessable, a local attacker can create a symbolic link from the expected lockfile path to a sensitive file owned by the victim (such as .rhosts). When Pine attempts to write the process ID to the lockfile, it instead writes to the linked file, allowing the attacker to modify its contents and escalate privileges. This issue was addressed in version 3.94 and later.
Affected products
- University of Washington Pine before 3.94
Timeline
- 1996-08-26: disclosed: Initial bug report on Bugtraq by Sean B. Hamor
- 1996-08-26: advisory: NVD publication date
- 1996-08-26: patched: Confirmed fixed in version 3.95; advisory states fixed in 3.94