#!/usr/bin/perl
#
# pop3.saint
#
# Check for vulnerable pop3d versions

require 'config/paths.pl';
require 'perl/misc.pl';

print "BEGIN\n";
die "Usage: $0 <target>" if $#ARGV < 0;
$target = $ARGV[0];
$port = 110;

$service = "pop-3";
$status = "a";
$trustee = "ANY\@ANY";
$trusted = "ANY\@ANY";
$service_output = "pop version";
$text = "vulnerable pop3 version: ";

$args = "-b $target $port";
open(POPSCAN, "$TCP_SCAN $args 2>/dev/null |")
	|| die "Cannot run $TCP_SCAN";

while(<POPSCAN>) {

  # All POP banners include "OK"
  if (/OK/i) {

    # Ignore servers with no known vulnerabilities
    if (!/(Microsoft|Windows NT|IMail|UCX|Solstice|Apple)/i) {

	# Check for vulnerable Netscape POP servers
	if (/Netscape/i && /v(\d+)\.([\d\.]+)/ &&
	    ($1<3 || ($1==3 && $2<=55))) {
		$severity = "bo";
		$text .= "Netscape $1.$2";
		&saint_print;
	}

	# Check for vulnerable QPopper versions
	# (<2.53 and Beta <3.0b20 are vulnerable)
	# (4.0 - 4.0.2 are vulnerable)
	elsif (/QPOP/i) {
	  if (/\(version (\d+)\.([\d\.]+)b?(\d*)/i) {
	    if ($1 < 2 || ($1==2 && $2<=5)) {
		$severity = "bo";
		$text .= "QPopper 2.5 or older";
		&saint_print;
	    } elsif ($1==2 && $2<=53) {
		$severity = "bo";
		$text .= "QPopper 2.53 or older";
		&saint_print;
	    } elsif ($1==3 && $2==0 && $3<=20) {
		$severity = "bo";
		$text .= "QPopper 3.0b20 or older";
		&saint_print;
	    } elsif ($1==4 && $2<=0.2) {
		$severity = "bo";
		$text .= "QPopper 4.0.2 or older";
		&saint_print;
	    }
	  }
	}
	
	# Check for vulnerable QVT/Net versions
	elsif (/\(QVT\/Net\s+(\d+)\.([\d\.]+)\)/ &&
		($1 < 4 || ($1==4 && $2<=20))) {
	    $severity = "bo";
	    $text .= "QVT/Net 4.20 or older";
	    &saint_print;
	}

	# Check for vulnerable Mercury MTA for Netware
	elsif (/MercuryP\/NLM\s+v(\d+)\.([\d\.]+)/i &&
		($1 < 1 || ($1==1 && $2<=48))) {
	    $severity = "zcio";
	    $text .= "Mercury 1.48 or older";
	    &saint_print;
	}

	# Check UW POP versions (pre 3.3(27))
	elsif (/3\.([\d\.]+)\((\d+)\)/ &&
		$1 < 3 || ($1==3 && $2 <= 27)) {
	    $severity = "zcio";
	    $text .= "UW 3.3r27 or older";
	    &saint_print;
	}
    }
  }
}

close POPSCAN;
