#!/bin/sh
#
# 
# pop.sara: version 2.1,  8 Mar 99, 23:30:00, last mod by todd
# pop.sara: version 2.2, 12 Jun 00, 13:30:00, last mod by todd
# pop.sara: version 2.3, 12 Jun 01, 13:30:00, last mod by todd
#
#  Searches for mostly UW/QPOP POP3 servers that are vulnerable
#  Also finds vulnerable Netscape servers
#

. config/paths.sh

tmp_file="./tmp_file.$$"
OK_V_UW=3.337
OK_V_NS=3.56
OK_V_Q=254
OK_V_Q4=403
status="OK"
target=$1
port=110

if $TEST "X$target" = "X" ; then
        $ECHO Usage $0 target
        exit 1
fi

$TCP_SCAN -b $target $port > $tmp_file 2> /dev/null
# If no "OK", then not POP
VERSION=`$GREP OK $tmp_file`
if [ -z "$VERSION" ]; then
  $RM -f $tmp_file
  exit 0
fi
#  If Microsoft then OK
if [ "`$ECHO $VERSION | $GREP -i Microsoft`" ]; then  
   status=OK
elif [ "`$ECHO $VERSION | $GREP -i NT`" ]; then
   status=OK
# If IMAIL then OK
elif [ "`$ECHO $VERSION | $GREP -i IMail`" ]; then
   status=OK
# If UCX no reported vulnerabilities
elif [ "`$ECHO $VERSION | $GREP -i UCX`" ]; then
   status=OK
# If Solstice then OK
elif [ "`$ECHO $VERSION | $GREP -i Solstice`" ]; then
   status=OK
# If Apple then OK
elif [ "`$ECHO $VERSION | $GREP -i Apple`" ]; then
   status=OK
#  If NetScape then mostly OK
elif [ "`$ECHO $VERSION | $GREP -i NetScape`" ]; then
   VERSION=`$ECHO $VERSION | $AWK '{print $8}' | $SED -e "s/v//g" | $SED -e "s/)//g"`
   
   RESULT=`$ECHO "$VERSION - $OK_V_NS" | bc`
   if [ "`$ECHO $RESULT | $GREP \-`" ]; then
     status=BAD
     type="Netscape"
   fi
# Check on QPopper
elif [ "`$ECHO $VERSION | $GREP QPOP`" ]; then
   VERSION=`$ECHO $VERSION|$AWK '{print $4}'|$SED -e "s/)//g"|$SED -e "s/\.//g"`
   if [ $VERSION -lt $OK_V_Q ]; then 
     status=BAD
     type=QPOP
   elif  [ $VERSION -ge 400 ]; then
     if [ $VERSION -lt $OK_V_Q4 ]; then 
       status=BAD;
       type=QPOP4
     fi
   fi 

elif [ "`$ECHO $VERSION | $GREP QUALCOM | $GREP \"version 2.[1-4]\"`" ]; then
     status=BAD
     type=QPOP
#  If an older version of UW POP
elif [  "`$ECHO $VERSION | $GREP [1-3][0-9]\(`" ]; then 
    status=MAYBE
    type=UW
fi
if [ "$status" = BAD ]; then
	service="pop-3"
	status="a"
	trustee="ANY@ANY"
	trusted="ANY@ANY"
	service_output="pop3 version"
	text="pop3 version ($type) may be vulnerable to buffer overflow"
       	severity="ycio"
	$ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
else
	service="pop-3"
	status=a
	trustee=""
	trusted=""
	severity="g"
	service_output=""
	text="offers pop3"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi
  $RM -f $tmp_file
  bin/pop0.sara $target
exit 0

# finis
