-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fetchmail-SA-2026-01: --enable-NTLM potential denial of service

Topics:		Possible abort when receiving long NTLM challenge
                when certain stack protection is enabled on the build.

Author:		Matthias Andree
Version:	1.0
Announced:	2026-06-27
Type:		failure to validate network input in certain configurations
Impact:		may set off memory hardening guards and cause program abort
Severity:	- low if built with NTLM and certain hardenings
                - none if NTLM disabled during build

URL:		https://www.fetchmail.info/fetchmail-SA-2026-01.txt
Project URL:	https://www.fetchmail.info/
CVE Name:	None required.

Affects:	- fetchmail releases 5.0.8 up to and including 6.6.6

Not affected:	- fetchmail release candidate 6.6.7.rc1
		- fetchmail alpha 7.0.0-alpha11 or newer (dropped NTLM support)

Introduced in:	1999-09-14 fetchmail release 5.0.8 added NTLM

Corrected in:	2026-06-26 Git commit cb5be5c38471eec19e519ace0bc569176317ea92
		2026-06-27 fetchmail release candidate 6.6.7.rc1

History:	1.0 2026-07-23 revised announcement, revoked vulnerability
		0.9 2026-06-27 separate announcement mailed
		    2024-11-13 fetchmail 6.5.1 started discouraging NTLM use


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail can be configured at build time with --enable-NTLM to support
SASL authentication via the NTLM method.  It will be attempted on all
servers that advertise it automatically, unless a specific other authentication
method is configured.

fetchmail has discouraged use of NTLM at configure time
since release 6.5.1 in November 2024, but some distributors may package
fetchmail in a way that it supports NTLM.


2. Problem description and Impact
=================================

In earlier reports, the effect of the bug which does exist was overestimated.

The NTLM authentication scheme is a three-part challenge-response scheme that
consists of 1 - a negotiate message (request), 2 - a challenge message,
3 - an authenticate message (response), fetchmail's name in parentheses.

When fetchmail builds the authenticate message in buildSmbNtlmAuthReponse,
it uses an internal macro AddBytes, to transfer data from the the received
challenge message, which in extreme cases can cause fetchmail to overwrite
the output buffer - which was allocated as C array (vector) on the stack,
by - as the original report received claims - 52 bytes.
  Root cause is insufficient validation of the remaining destination buffer
capacity before triggering a copy of data.

HOWEVER this is believed to be non-exploitable beyond denial of service
to the client, which can either stem from the client getting the
"NegotiateFlags" contents wrong, and the server then rejecting the
authentication, OR because the client may have been compiled with
options that guard stack variables by putting safe areas around them
and causing the guards/protectors/hardening features to abort
fetchmail.  The maximum length of the overrun is around 52 (original report)
or maybe a few bytes more, but on both sides of the overflowed variable
there are other stack variables with at least 2048 bytes of size,
so the overrun does not get anywhere near frame pointers, return addresses,
saved registers or other status that would allow modifying the control flow.

The earlier report is herewith revoked.


3. Solutions
============

None required. Fetchmail 6.6.7.rc1 and newer will give a clear error message
in this situation that an internal buffer is insufficiently sized, whereas
older versions might just corrupt the NTLM Authenticate Message (the final
one from the three-part authentication handshake).

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about the malfunctioning SMTP server, or on fetchmail's end
to replace local delivery by different server or other means.


A. Copyright, License and Non-Warranty
======================================

(C) Copyright 2026 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2026-01
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmpipIQACgkQ5BKxVu/z
hVrLvw/9HwL5Ga7v3N5Gzgtp6yS7dojlbXikE9nub6JTBWtvcdjjN0tBIUpCbr/q
zMnUWThXnEJ7UC2S9UYGjv9c7wpbunSGtWu3iNyD7kgb6bpkFrhRRFuk6gcMZDuK
Ozfm7lCF9ESsq7oGyiHXrxe8MXUHxj0wDXuUFYjx+v0L0EWJKoVed5i31ZhVmpUg
sEp2Us19TbsogHTeV37ZSbMd+L/n5pjlTE+3T1XGz3vmVwcxNrRGbZ7c3EnO0XxV
u35/dxxvSycUsfE6UJ8z7ji7s7S4aHvJ6scD0Avz5b3cOPWV0NVlCW9c9KPHjq/o
pElaPjP0PIODLJBkwhpfnDwCkx1Zs3O8QFgAC147/V6bjUhztNXt6TVWM7elyv9q
lS0/40HmQ9YKy6G67PC74eMlHsVaOBD3CQYpFHjzka2lELXVEE+Bxuzj/5W9BewZ
EFKW+TBT+QdWvfU6kZBHNqn95S4eXA2D03ABrB+1s4pwKaq1hPSyg7Ls2scENqaD
wNKeCxBn1+ugtcT48Ox24H7+fkU+SzxK/JPjB9F6jwM6rs9WErVo2WSvEhmn+9I6
ileR8vBD26FEiYqZ7FsUX28JvIesjvI6oMYlipJJYvM2lwpVCKw7QqqFxcflYdWp
DelWEwY29s1aMAlBUg2kNOpMtAEewGClNG1tqMVxAh/mgauOXZ0=
=3PcE
-----END PGP SIGNATURE-----
