Vulnerabilities > CVE-2003-0721 - Improper Validation of Array Index vulnerability in Washington Pine

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

washington

CWE-129

nessus

NVD

Published: 2003-09-17

Updated: 2024-02-09

Summary

Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.

Vulnerable Configurations

Part	Description	Count
Application	Washington Washington Pine 0.9.439 Washington Pine 0.9.500 Washington Pine 0.9.600 Washington Pine 0.9.650 Washington Pine 1.0.3 Washington Pine 1.0.14.100 Washington Pine 1.0.15.150 Washington Pine 1.0.16.1 Washington Pine 1.0.16.100 Washington Pine 1.0.17.1 Washington Pine 1.0.19.1 Washington Pine 1.0.20.1 Washington Pine 1.0.21.1 Washington Pine 1.0.22.1 Washington Pine 1.0.23.1 Washington Pine 1.0.24.1 Washington Pine 1.0.25 Washington Pine 1.0.26 Washington Pine 2.0 Washington Pine 2.1 Washington Pine 2.2 Washington Pine 2.3 Washington Pine 2.4 Washington Pine 2.10 Washington Pine 2.15 Washington Pine 2.20 Washington Pine 2.21 Washington Pine 2.24 Washington Pine 2.25 Washington Pine 2.26 Washington Pine 2.27 Washington Pine 2.28 Washington Pine 2.29 Washington Pine 2.30 Washington Pine 2.31 Washington Pine 2.32 Washington Pine 2.33 Washington Pine 3.00 Washington Pine 3.01 Washington Pine 3.02 Washington Pine 3.03 Washington Pine 3.04 Washington Pine 3.05 Washington Pine 3.06 Washington Pine 3.07 Washington Pine 3.50 Washington Pine 3.51 Washington Pine 3.52 Washington Pine 3.73 Washington Pine 3.80 Washington Pine 3.81 Washington Pine 3.83 Washington Pine 3.84 Washington Pine 3.85 Washington Pine 3.86 Washington Pine 3.87 Washington Pine 3.88 Washington Pine 3.89 Washington Pine 3.90 Washington Pine 3.91 Washington Pine 3.92 Washington Pine 3.93 Washington Pine 3.94 Washington Pine 3.95 Washington Pine 3.96 Washington Pine 4.00 Washington Pine 4.01 Washington Pine 4.02 Washington Pine 4.03 Washington Pine 4.04 Washington Pine 4.05 Washington Pine 4.10 Washington Pine 4.20 Washington Pine 4.21 Washington Pine 4.30 Washington Pine 4.31 Washington Pine 4.32 Washington Pine 4.33 Washington Pine 4.40 Washington Pine 4.41 Washington Pine 4.42 Washington Pine 4.43 Washington Pine 4.44 Washington Pine 4.50 Washington Pine 4.51 Washington Pine 4.52 Washington Pine 4.53 Washington Pine 4.55 Washington Pine 4.56	91

Common Weakness Enumeration (CWE)

CWE-129 - Improper Validation of Array Index

Common Attack Pattern Enumeration and Classification (CAPEC)

Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.

Nessus

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_39BD57E65D8311D880E30020ED76EF5A.NASL
description	Pine versions prior to 4.58 are affected by two vulnerabilities discovered by iDEFENSE, a buffer overflow in mailview.c and an integer overflow in strings.c. Both vulnerabilities can result in arbitrary code execution when processing a malicious message.
last seen	2020-06-01
modified	2020-06-02
plugin id	37712
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/37712
title	FreeBSD : pine remotely exploitable vulnerabilities (39bd57e6-5d83-11d8-80e3-0020ed76ef5a)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2003-274.NASL
description	Updated Pine packages that resolve remotely exploitable security issues are now available. Pine, developed at the University of Washington, is a tool for reading, sending, and managing electronic messages (including mail and news). A buffer overflow exists in the way unpatched versions of Pine prior to 4.57 handle the
last seen	2020-06-01
modified	2020-06-02
plugin id	12420
published	2004-07-06
reporter	This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/12420
title	RHEL 2.1 : pine (RHSA-2003:274)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PINE_458.NASL
description	The following package needs to be updated: iw-pine
last seen	2016-09-26
modified	2004-07-06
plugin id	12602
published	2004-07-06
reporter	Tenable
source	https://www.tenable.com/plugins/index.php?view=single&id=12602
title	FreeBSD : pine remotely exploitable vulnerabilities (151)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SA_2003_037.NASL
description	The remote host is missing the patch for the advisory SUSE-SA:2003:037 (pine). The well known and widely used mail client pine is vulnerable to a buffer overflow. The vulnerability exists in the code processing
last seen	2020-06-01
modified	2020-06-02
plugin id	13805
published	2004-07-25
reporter	This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/13805
title	SUSE-SA:2003:037: pine

Oval

accepted

2007-04-25T19:52:33.657-04:00

class

vulnerability

contributors

name Jay Beale
organization Bastille Linux
name Jay Beale
organization Bastille Linux
name Thomas R. Jones
organization Maitreya Security

description

family

unix

oval:org.mitre.oval:def:503

status

accepted

submitted

2003-09-12T12:00:00.000-04:00

title

Integer Signedness Error in PINE

version

Redhat

advisories

rhsa
id RHSA-2003:273
rhsa
id RHSA-2003:274

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Oval

Redhat

References