#!/usr/bin/perl
#
# tooltalk.saint
#
# identify operating systems which have
# vulnerable versions of tooltalk
#
# Usage: tooltalk.saint [OS type] target [FW][.PLUS]
#
# Sam Kline, WWDSI, 6/00
# updated for new format string vulnerability, s.k., 10/01
#
require 'perl/misc.pl';

print "BEGIN\n";
$argptr = $#ARGV;
if (($ARGV[$argptr] eq "FW") ||
    ($ARGV[$argptr] eq ".PLUS") ||
    ($ARGV[$argptr] eq "FW.PLUS")) { $argptr--; }

$target = $ARGV[$argptr];
$service = "ttdbserverd";
$argptr--;

if ($argptr < 0) {
  $ostype = "UNKNOWN";
} else {
  $ostype = join (" ", @ARGV[0..$argptr]);
}

$status = "a";
$trusted = "ANY@$target";
$trustee = "ANY@$target";
$service_output = "tooltalk version";

if (($ostype eq "SunOS") ||
    ($ostype =~ /SunOS 4/) ||
    ($ostype eq "SunOS 5") ||
    ($ostype =~ /SunOS 5.[0-6]/) ||
    ($ostype =~ /Solaris 2.[0-6]/) ||
    ($ostype eq "HP-UX") ||
    ($ostype =~ /HP-UX.+10\./) ||
    ($ostype =~ /HP-UX.+11\.0/) ||
    ($ostype eq "IRIX") ||
    ($ostype =~ /IRIX 5/) ||
    ($ostype eq "IRIX 6") ||
    ($ostype =~ /IRIX 6.[2-4]/) ||
    ($ostype eq "AIX") ||
    ($ostype =~ /AIX 4.[1-3]/)) {
	$severity = "bo";
	$text = "tooltalk version may be vulnerable to buffer overflow";
	&saint_print();
	$text = "possible format string vulnerability in tooltalk";
	&saint_print();
} elsif (($ostype =~ /HP-UX.+11\.11/) ||
	 ($ostype =~ /AIX 5\.1/) ||
	 ($ostype =~ /SunOS 5\.[78]/) ||
	 ($ostype =~ /Solaris 2\.[78]/) ||
	 ($ostype =~ /Solaris [78]/) ||
	 ($ostype eq "SCO") ||
	 ($ostype =~ /UnixWare 7/) ||
	 ($ostype =~ /Digital Unix 4\.0f/i) ||
	 ($ostype eq "Tru64") ||
	 ($ostype =~ /Tru64 4/) ||
	 ($ostype =~ /Tru64 5\.0/) ||
	 ($ostype eq "Tru64 5.1") ||
	 ($ostype =~ /Tru64 5\.1a/)) {
	$severity = "bo";
	$text = "possible format string vulnerability in tooltalk";
	&saint_print();
} elsif ($ostype eq "UNKNOWN") {
	$severity = "zcio";
	$text = "tooltalk version may be vulnerable to buffer overflow";
	&saint_print();
	$text = "possible format string vulnerability in tooltalk";
	&saint_print();
}
