/*
 * 
 * imap
 *
 * This plugin was written by Renaud Deraison and is released
 * under the GPL
 *
 */
#include <includes.h>

#define NAME "imap buffer overflow"
#define DESC "\
There's a bug on some versions of Imap which allow a remote user\n\
to become root using a buffer overflow\n\
This plugin determines if the remote imap is subject to this\n\
attack\n\n\
Risk factor : high"
#define COPYRIGHT "no copyright"
#define SUMM "imap buffer overflow"



PlugExport int plugin_init(struct arglist *desc);
PlugExport int plugin_init(struct arglist *desc)
{
	plug_set_name(desc, NAME);
	plug_set_description(desc, DESC);
	plug_set_summary(desc, SUMM);
	plug_set_copyright(desc, COPYRIGHT);
	plug_set_category(desc, ACT_GATHER_INFO);
	plug_set_family(desc, "Gain root remotely");
	return(0);
}

     

PlugExport int plugin_run(struct arglist * args);	
PlugExport int plugin_run(struct arglist * args)
{
	if(host_get_port_state(args, 143)>0)
	{
	 int soc = open_sock_tcp(args, 143);
	 if(soc<0)return(0);
	 else
	 {
	  char * buf = emalloc(1024);
	  char * command;
	  memset(buf, 'A', 1023);
	  command = emalloc(2048);
          recv_line(soc, command, 2048);
	  sprintf(command, "%d LOGIN %s\n", strlen(buf), buf);
	  efree(&buf);
#ifndef NESSUS_NT
          signal(SIGPIPE, SIG_IGN);
#endif
	  send(soc, command, strlen(command),0);
	  recv_line(soc, command, 2048);
	  if(!strlen(command))
	   post_hole(args, 143, 
"The remote imap is subject to a buffer overrun attack\n\
which may allow any remote user to become root easily\n");
	 efree(&command);
	 socket_close(soc);
	}
	}
	return(0);
}
