CVE-2000-0353: Critical severity University of Washington pine vulnerability
Pine 4.x allows a remote attacker to execute arbitrary commands via an index.html file which executes lynx and obtains a uudecoded file from a malicious web server, which is then executed by Pine.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Pine 4.xfrom your environment.Uninstall or stop using Pine 4.x on affected systems until a vendor-supplied fix or patched version is available.
- Configuration
Disable HTML rendering or automatic retrieval of external resources in Pine to prevent index.html from invoking lynx or fetching and executing remote uuencoded files.
Pine HTML rendering / automatic external content retrieval = disabled - Compensating control
Block or restrict outbound HTTP/HTTPS access from hosts running Pine to untrusted web servers at the network perimeter (firewall/ACL) and restrict access to untrusted index.html files to prevent retrieval of malicious content.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0353?
CVE-2000-0353 is classified as high severity due to its ability to allow remote command execution.
How do I fix CVE-2000-0353?
To fix CVE-2000-0353, upgrade to Pine version 4.21 or later, which addresses this vulnerability.
What versions of Pine are affected by CVE-2000-0353?
CVE-2000-0353 affects Pine versions 3.98, 4.0, 4.2, and 4.10.
How does CVE-2000-0353 allow exploitation?
CVE-2000-0353 allows exploitation by executing arbitrary commands via a crafted index.html file.
What type of attack is facilitated by CVE-2000-0353?
CVE-2000-0353 facilitates a remote code execution attack through compromised HTML content.