Kerio MailServer < 6.3.1 Long LDAP Query DoS

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(23868);
  script_version("1.16");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_cve_id("CVE-2006-6554");
  script_bugtraq_id(21091);

  script_name(english:"Kerio MailServer < 6.3.1 Long LDAP Query DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote LDAP server is prone to a denial of service attack.");
  script_set_attribute(attribute:"description", value:
"The remote host is running Kerio MailServer, a commercial mail server
available for Windows, Linux, and Mac OS X platforms. 

According to its banner, the LDAP service associated with the
installed version of Kerio MailServer terminates abnormally when it
receives certain malformed LDAP search requests.  An unauthenticated,
remote attacker can exploit this issue to deny access to legitimate
users.");
  script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/454455/30/0/threaded");
  script_set_attribute(attribute:"see_also", value:"http://forums.kerio.com/index.php?t=msg&th=10321&start=0");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Kerio MailServer 6.3.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/12/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2006/12/15");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:kerio:personal_mailserver");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Denial of Service");

  script_copyright(english:"This script is Copyright (C) 2006-2022 Tenable Network Security, Inc.");

  script_dependencies("ldap_detect.nasl", "smtpserver_detect.nasl");
  script_require_ports("Services/ldap", 389, "Services/smtp", 25);

  exit(0);
}


include("smtp_func.inc");


ldap_port = get_kb_item("Services/ldap");
if (!ldap_port) ldap_port = 389;
if (!get_port_state(ldap_port)) exit(0);


smtp_port = get_kb_item("Services/smtp");
if (!smtp_port) smtp_port = 25;
if (!get_port_state(smtp_port)) exit(0);


# Check the version in the SMTP banner.
banner = get_smtp_banner(port:smtp_port);
if (banner && banner =~ "^220 .* Kerio MailServer ([0-5]\.|6\.([0-2]\.|3\.0([^0-9]|$)))")
  security_warning(ldap_port);