Description
Pine before version 4.21 does not properly filter shell metacharacters from URLs, which allows remote attackers to execute arbitrary commands via a malformed URL.
References
- 810 vdb-entry
- 19991117 Pine: expanding env vars in URLs (seems to be fixed as of 4.21) mailing-list
- 19991227 Security hole in Pine < 4.21 vendor-advisory