In Pine, if a user selects a URL with the structure of:
http://address/'&/some/program${IFS}with${IFS}arguments&'
And the URL handlers are installed, they will end up with the browser open on:
http://address/
And
/some/program with arguments
Will be executed.
If the attacked user is reading his email as root these commands will execute as root.
If you are reading your email as a non-privileged user, the impact is somewhat lower, although local exploits could be run on the computer, or Outlook style email viruses could be executed.
If you do not view links given to you in Pine, the impact from this problem is non-existent.
It is possible to obfuscate the URL by putting it in an HTML message such as the following.
Rather than trying to be smart about quoting and
meta-characters, we just stuff the URL into an environment
variable and make the handler use it.
Last update: Dec 06 2001 by Lenz Grimmer