#!/usr/bin/perl
#
# imap.saint
# re-written in PERL, 2/26/01 (s.k.)

require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";
$vulnerable="OK";
$target=$ARGV[0];
$port=143;

if (!$target) {
        print "Usage: imap.saint <target>\n";
        exit 1;
}

open (SCAN, "$TCP_SCAN -b $target $port|") || die "cannot run $TCP_SCAN";

while(<SCAN>) {

  # If no "OK", then not IMAP
  exit 0 unless /OK/;

  $_ =~ s/\[.*\]//;
  if (/Microsoft/i) {
    $vulnerable = "OK";
  } elsif (/NTMail/i || /Netscape/i || /IMail/i) {
    $vulnerable = "OK";
  } elsif (/v\[8\.9\]/ || (/Service/ && /\[8\.9\]/)) {
    $vulnerable = "RED";
  } else {
    @banner = split /\s+/;
    $service = $banner[3];
    $version = $banner[4];
    if ($version =~ /v(\d+)\.(\d+)/) {
      if ($1 < 10 || ($1==10 && $2<234)) {
	$vulnerable = "RED";
      } else {
	$vulnerable = "YELLOW";
      }
    } elsif ($service =~ /IMAP4rev1/i && $version =~ /(\d{4})\.(\d+)/) {
      if ($1 < 2001) {
	$vulnerable = "YELLOW";
      }
    }
  }
}
close SCAN;

$service="imap";
$status="a";
$trustee="ANY\@ANY";
$trusted="ANY\@ANY";
$service_output="imap version";

if ($vulnerable eq "RED") {
	$text="imap version may be vulnerable to buffer overflow";
       	$severity="bo";
	&saint_print();
} elsif ($vulnerable eq "YELLOW") {
	$text="imap version allows shell access";
	$severity="ype";
	&saint_print();
}
