Pine 4.x - Empty MIME Boundary Denial of Service

Author: Martin J. Muench
type: dos
platform: unix
port: 
date_added: 2002-07-24 
date_updated: 2012-10-01 
verified: 1 
codes: CVE-2002-2325;OSVDB-60238 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5301/info

Pine is an open source mail user agent distributed by the University of Washington. It is freely available for Unix, Linux, and Microsoft Operating Systems.

When a mail is received by pine that contains MIME content, and the value of the MIME boundary is blank, pine becomes unstable. This vulnerability has been discovered to cause a core dump in the pine client, and could be used to deny service to legitimate users of the client.

Sending an email to a pine user containing MIME content with the following fields set as specified will cause the crash:

Content-Type: multipart/mixed; boundary=""
Mime-Version: 1.0