fetchmail-SA-2026-01: --enable-NTLM potential remote code execution

Topics:		Possible remote code execution from stack buffer overflow
		when compiler rearranges arrays on stack and
		receiving long NTLM challenge from rogue server

Author:		Matthias Andree
Version:	1.2 TODO
Announced:	2026-06-27, revised 2026-09-11
Type:		failure to validate network input in certain configurations
Impact:		attacker may write a few dozen bytes on stack
Severity:	- high if built with NTLM and compiler rearranges
                  arrays on the stack
		- none if NTLM disabled during build, or if
		  compiler does not place the "response" structure
		  at the top of the stack in ntlm_helper function
Credit:		Tristan Madani (report and discussion)

URL:		https://www.fetchmail.info/fetchmail-SA-2026-01.txt
Project URL:	https://www.fetchmail.info/
CVE Name:	pending
CWE Id:		CWE-121 stack based buffer overflow

Affects:	- fetchmail releases 5.0.8 up to and including 6.6.6

Not affected:	- fetchmail release candidate 6.6.7.rc1
		- fetchmail alpha 7.0.0-alpha11 or newer (dropped NTLM support)

Introduced in:	1999-09-14 fetchmail release 5.0.8, which added NTLM

Corrected in:	2026-06-26 Git commit cb5be5c38471eec19e519ace0bc569176317ea92
		2026-06-27 fetchmail release candidate 6.6.7.rc1

History:	    2026-09-11 removed SMTP-related part from section 3.
		1.1 2026-09-11 revised, vulnerable with certain compilers
		1.0 2026-07-23 revised announcement, revoked vulnerability
		0.9 2026-06-27 separate announcement mailed
		    2024-11-13 fetchmail 6.5.1 started discouraging NTLM use


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail can be configured at build time with --enable-NTLM to support
SASL authentication via the NTLM method.  This will be attempted automatically
on all servers that advertise it, unless a specific other authentication
method is configured.

fetchmail has discouraged use of NTLM at configure time since release 6.5.1
in November 2024, but some distributors may package fetchmail in a way
that it supports NTLM still.


2. Problem description and Impact
=================================

The NTLM authentication scheme is a three-part challenge-response scheme that
consists of 1 - a negotiate message (request), 2 - a challenge message,
3 - an authenticate message (response), fetchmail's name in parentheses.
1 and 3 are generated by the client, fetchmail, and 2 by the server.

When fetchmail builds the authenticate message in buildSmbNtlmAuthReponse,
it uses an internal macro AddBytes to transfer data from the the received
challenge message (2) into the buffer holding the authenticate response,
which in extreme cases can cause fetchmail to overwrite the output buffer
- which was allocated as C array (vector) on the stack, by a two-digit
amount of bytes.
  The root cause is insufficient validation of the remaining destination
buffer capacity before triggering a copy of data.

Tristan Madani pointed out, after the 6.6.7 release, that there is no
control as to how compilers lay out the array variables on the stack,
yet if this is exploitable depends on the exact layout of the stack frame
of the ntlm_helper function.
  Compilers have a certain freedom as to where to place what variables.
An attacker can only gain control over the program flow if the compiler
arranges the stack frame to put the "response" variable at the highest
address, close to the return addresses.  If any other of the large
variables (the function has four in total) is at the top of the stack
frame, the damage is contained in another variable and worst case the
authentication fails because the "flags" variable is corrupted.


3. Solution
===========

Update to fetchmail 6.6.7. It will give a clear error message
in this situation that an internal buffer is insufficiently sized.

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about malfunctions of all kinds.


4. Workaround
=============

Recompile and reinstall fetchmail WITHOUT options/configuration that would
enable NTLM, i. e. omit the --enable-NTLM option on the ./configure command
line, and do not enable them via modification of header files.



A. Copyright, License and Non-Warranty
======================================

(C) Copyright 2026 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2026-01
