Re: remote exploit on pine 4.10 - neverending story?

[serge () yahoo-inc com (Sergiy Zhuk)]

hi

On Mon, 8 Feb 1999, Anton Chuvakin wrote:

> Can a private mailcap instead of /etc/mailcap be used (the pine config
> implies this)? Can a pine treatment of MIME types be changed (OPTION:
> mimetype-search-path in config implies so)?

pine v3.96 (up to 4.x), has 'mailcap-search-path' and 'mimetype-search-path'
options.
If you set them the following way, pine will read only your private files:
mailcap-search-path      = ~your_login/.mailcap
mimetype-search-path     = ~your_login_name/.mime.types

In addition, here is the patch for pine/mailcap.c, pine 3.96:

--- mailcap.c.orig      Mon Jul 15 11:05:10 1996
+++ mailcap.c   Mon Feb  8 17:26:12 1999
@@ -839,12 +839,14 @@
                     * have to put those outside of the single quotes.
                     */
                    for(p = parm->value; *p; p++){
-                       if(*p == '\''){
+                       if( (*p == '\'') || (*p=='`') ){
                            *to++ = '\'';  /* closing quote */
                            *to++ = '\\';
-                           *to++ = '\'';  /* below will be opening quote */
+                           *to++ = *p; /* quoted char */
+                           *to++ = '\''; /* opening quote */
                        }
-                       *to++ = *p;
+                       else
+                          *to++ = *p;
                    }
                }

--
rgds,
serge