Pine Unix用户名帐户信息泄露漏洞发布时间：2002-06-13 更新时间：2002-06-13 严重程度：中 威胁程度：服务器信息泄露 错误类型：设计错误 利用方式：服务器模式 BUGTRAQ ID：4963 受影响系统 University of Washington Pine 4.21详细描述 pine是免费开放源代码邮件用户客户端MUA，可使用在多种操作系统下。 Pine会泄露原始发送者的UNIX用户名，当邮件发送后，pine会在邮件头增加"Sender:"或者"X-X-Sender:"字段形式的信息，这可以允许远程攻击者发现发送邮件用户的用户名，导致信息泄露。 测试代码 无 解决方案 Roger Marquis <marquis@roble.com>提供如下补丁： -------------------------------------------------------------------- --- pine/send.c.orig Tue Jan 8 12:59:37 2002 +++ pine/send.c Sat Mar 9 09:17:08 2002 @@ -3989,12 +3989,15 @@ outgoing->return_path = rfc822_cpy_adr(outgoing->from); + /* * Don't ever believe the sender that is there. * If From doesn't look quite right, generate our own sender. */ + /**** fix u-washington anti-privacy loophole if(outgoing->sender) mail_free_address(&outgoing->sender); + /**** /* * If the LHS of the address doesn't match, or the RHS @@ -4003,6 +4006,7 @@ * * Don't add a personal_name since the user can change that. */ + /**** fix u-washington anti-privacy loophole if(!outgoing->from || !outgoing->from->mailbox || strucmp(outgoing->from->mailbox, ps_global->VAR_USER_ID) != 0 @@ -4014,6 +4018,7 @@ outgoing->sender->mailbox = cpystr(ps_global->VAR_USER_ID); outgoing->sender->host = cpystr(ps_global->hostname); } + /**** /*----- Message is edited, now decide what to do with it ----*/ if(editor_result & (COMP_SUSPEND | COMP_GOTHUP | COMP_CANCEL)){ -------------------------------------------------------------------- 相关信息 Roger Marquis <marquis@roble.com>. 参考：http://online.securityfocus.com/archive/1/276029 相关主页：http://www.washington.edu/pine/ |
