CVE:CVE-2002-1320
CNNVD:CNNVD-200212-014
Pine是一款开放源代码的EMAIL客户端。
Pine对From:字段数据处理不正确，远程攻击者可以利用这个漏洞发送恶意邮件导致Pine发生基于堆的破坏，造成Pine客户端崩溃。
当Pine检测到邮件的From头字段类似如下形式：
From:
"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar
可导致Pine由于段错误而崩溃。攻击者可以发送特殊构建的From头字段而完全合法兼容RFC的邮件消息给目标Pine用户，可使Pine在启动的时候发生core dump。唯一的方法是从spool或者使用其他MUA手工删除这个错误邮件，否则不能使用Pine来接收邮件。
solution:Upgrade university_of_washington pine to a higher version than 3.98,4.0.2,4.0.4,4.10,4.20,4.21,4.30,4.33,4.44,and avoid the version 3.98,4.0.2,4.0.4,4.10,4.20,4.21,4.30,4.33,4.44