#!/bin/sh
#
# 
# imap.sara: version 2.2, 8 jul 04, 23:30:00, last mod by todd
#
#  Searches for mostly UW IMAP servers that are vulnerable
#  Also finds vulnerable Netscape servers
#

. config/paths.sh

tmp_file="./tmp_file.$$"
OK_V_UW=10.234
OK_V_NS=3.56
status="OK"
target=$1
port=143

if $TEST "X$target" = "X" ; then
        $ECHO Usage $0 target
        exit 1
fi

$TCP_SCAN -b $target $port > $tmp_file 2>/dev/null
# If no "OK", then not IMAP
VERSION=`$GREP OK $tmp_file`
if [ -z "$VERSION" ]; then
  $RM -f $tmp_file
  exit 0
fi
#  If Microsoft then OK
if [ "`$ECHO $VERSION | $GREP -i Microsoft`" ]; then  
   status=OK
#  If NT Mail  mostly OK
elif [ "`$ECHO $VERSION | $GREP -i NTMail`" ]; then
   status=OK
#  If NetScape then mostly OK
elif [ "`$ECHO $VERSION | $GREP -i NetScape`" ]; then
   VERSION=`$ECHO $VERSION | $AWK '{print $6}'`
   RESULT=`$ECHO "$VERSION - $OK_V_NS" | bc`
   if [ "`$ECHO $RESULT | $GREP \-`" ]; then
     status=BAD
   fi
elif [  "`$ECHO $VERSION | $GREP -i IMAIL`" ]; then
     status=OK
elif [  "`$ECHO $VERSION | $GREP -i SUSE`" ]; then
   status=MAYBE
else
   VERSION=`$ECHO $VERSION | $AWK '{print $5}'` 
$ECHO $VERSION | $GREP "^v1"
   if [ "`$ECHO $VERSION | $GREP \"^v\"`" ]; then
     VERSION=`$ECHO $VERSION | $SED -e "s/v//g"`
     R0=`$ECHO $VERSION | sed -e "s/\.//g"`
     R1=`$ECHO $OK_V_UW | sed -e "s/\.//g"`
     if [ $R0 -lt $R1 ]; then
       status=BAD
     fi
   fi
fi
if [ "$status" = BAD ]; then
	service="imap"
	status="a"
	trustee="ANY@ANY"
	trusted="ANY@ANY"
	service_output="imap version"
	text="imap version may be vulnerable to buffer overflow"
       	severity="ycio"
	$ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
else
	service="imap"
	status=a
	trustee=""
	trusted=""
	severity="g"
	service_output=""
	text="offers imap"
        $ECHO "$target|$service|$status|$severity|$trustee|$trusted|$service_output|$text"
fi
  $RM -f $tmp_file
  bin/imap0.sara $target
exit 0

# finis
