-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 fetchmail-SA-2026-01: --enable-NTLM potential denial of service Topics: Possible abort when receiving long NTLM challenge when certain stack protection is enabled on the build. Author: Matthias Andree Version: 1.0 Announced: 2026-06-27 Type: failure to validate network input in certain configurations Impact: may set off memory hardening guards and cause program abort Severity: - low if built with NTLM and certain hardenings - none if NTLM disabled during build URL: https://www.fetchmail.info/fetchmail-SA-2026-01.txt Project URL: https://www.fetchmail.info/ CVE Name: None required. Affects: - fetchmail releases 5.0.8 up to and including 6.6.6 Not affected: - fetchmail release candidate 6.6.7.rc1 - fetchmail alpha 7.0.0-alpha11 or newer (dropped NTLM support) Introduced in: 1999-09-14 fetchmail release 5.0.8 added NTLM Corrected in: 2026-06-26 Git commit cb5be5c38471eec19e519ace0bc569176317ea92 2026-06-27 fetchmail release candidate 6.6.7.rc1 History: 1.0 2026-07-23 revised announcement, revoked vulnerability 0.9 2026-06-27 separate announcement mailed 2024-11-13 fetchmail 6.5.1 started discouraging NTLM use 1. Background ============= fetchmail is a software package to retrieve mail from remote POP3, IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or message delivery agents. fetchmail can be configured at build time with --enable-NTLM to support SASL authentication via the NTLM method. It will be attempted on all servers that advertise it automatically, unless a specific other authentication method is configured. fetchmail has discouraged use of NTLM at configure time since release 6.5.1 in November 2024, but some distributors may package fetchmail in a way that it supports NTLM. 2. Problem description and Impact ================================= In earlier reports, the effect of the bug which does exist was overestimated. The NTLM authentication scheme is a three-part challenge-response scheme that consists of 1 - a negotiate message (request), 2 - a challenge message, 3 - an authenticate message (response), fetchmail's name in parentheses. When fetchmail builds the authenticate message in buildSmbNtlmAuthReponse, it uses an internal macro AddBytes, to transfer data from the the received challenge message, which in extreme cases can cause fetchmail to overwrite the output buffer - which was allocated as C array (vector) on the stack, by - as the original report received claims - 52 bytes. Root cause is insufficient validation of the remaining destination buffer capacity before triggering a copy of data. HOWEVER this is believed to be non-exploitable beyond denial of service to the client, which can either stem from the client getting the "NegotiateFlags" contents wrong, and the server then rejecting the authentication, OR because the client may have been compiled with options that guard stack variables by putting safe areas around them and causing the guards/protectors/hardening features to abort fetchmail. The maximum length of the overrun is around 52 (original report) or maybe a few bytes more, but on both sides of the overflowed variable there are other stack variables with at least 2048 bytes of size, so the overrun does not get anywhere near frame pointers, return addresses, saved registers or other status that would allow modifying the control flow. The earlier report is herewith revoked. 3. Solutions ============ None required. Fetchmail 6.6.7.rc1 and newer will give a clear error message in this situation that an internal buffer is insufficiently sized, whereas older versions might just corrupt the NTLM Authenticate Message (the final one from the three-part authentication handshake). General recommendation: if running fetchmail in the background or in daemon mode, ensure that the daemon is supervised and crashes are reported so that action can be taken about the malfunctioning SMTP server, or on fetchmail's end to replace local delivery by different server or other means. A. Copyright, License and Non-Warranty ====================================== (C) Copyright 2026 by Matthias Andree, . Some rights reserved. This file is licensed under CC BY-ND 4.0. To view a copy of this license, visit THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES. Use the information herein at your own risk. END of fetchmail-SA-2026-01 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmpipIQACgkQ5BKxVu/z hVrLvw/9HwL5Ga7v3N5Gzgtp6yS7dojlbXikE9nub6JTBWtvcdjjN0tBIUpCbr/q zMnUWThXnEJ7UC2S9UYGjv9c7wpbunSGtWu3iNyD7kgb6bpkFrhRRFuk6gcMZDuK Ozfm7lCF9ESsq7oGyiHXrxe8MXUHxj0wDXuUFYjx+v0L0EWJKoVed5i31ZhVmpUg sEp2Us19TbsogHTeV37ZSbMd+L/n5pjlTE+3T1XGz3vmVwcxNrRGbZ7c3EnO0XxV u35/dxxvSycUsfE6UJ8z7ji7s7S4aHvJ6scD0Avz5b3cOPWV0NVlCW9c9KPHjq/o pElaPjP0PIODLJBkwhpfnDwCkx1Zs3O8QFgAC147/V6bjUhztNXt6TVWM7elyv9q lS0/40HmQ9YKy6G67PC74eMlHsVaOBD3CQYpFHjzka2lELXVEE+Bxuzj/5W9BewZ EFKW+TBT+QdWvfU6kZBHNqn95S4eXA2D03ABrB+1s4pwKaq1hPSyg7Ls2scENqaD wNKeCxBn1+ugtcT48Ox24H7+fkU+SzxK/JPjB9F6jwM6rs9WErVo2WSvEhmn+9I6 ileR8vBD26FEiYqZ7FsUX28JvIesjvI6oMYlipJJYvM2lwpVCKw7QqqFxcflYdWp DelWEwY29s1aMAlBUg2kNOpMtAEewGClNG1tqMVxAh/mgauOXZ0= =3PcE -----END PGP SIGNATURE-----