REDHAT-BUG-2537395: Buffer Overflow
A flaw was found in fetchmail. A stack-based buffer overflow exists in the NTLM client authentication code (ntlmhelper() / buildSmbNtlmAuthResponse() in smbutil.c) when fetchmail is built with --enable-NTLM. The AddBytes macro copies data from a server-supplied NTLM Type 2 challenge into a fixed 1024-byte stack buffer without validating remaining capacity. A malicious or compromised mail server that advertises NTLM can overwrite a few dozen bytes past the buffer. Depending on compiler stack-frame layout, this may allow remote code execution; otherwise the practical impact is authentication failure or process abort under stack hardening. Affects fetchmail 5.0.8 through 6.6.6. Fixed in 6.6.7 (commit cb5be5c38471eec19e519ace0bc569176317ea92). Red Hat Enterprise Linux builds enable NTLM and ship affected versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fetchmailto a version that resolves this vulnerability.Fixed in 6.6.7
Event History
Frequently Asked Questions
Which deployments are exposed to this flaw?
Fetchmail versions 5.0.8 through 6.6.6 are affected when built with NTLM support enabled. Red Hat Enterprise Linux builds enable NTLM and ship affected versions.
What must an attacker control to trigger the overflow?
An attacker needs to operate or compromise a mail server that advertises NTLM authentication and sends a crafted NTLM Type 2 challenge to the fetchmail client. The vulnerable data is copied from that server-supplied challenge into a fixed stack buffer.
What is the likely impact of exploitation?
Depending on compiler stack-frame layout, the overflow may permit remote code execution. On systems with stack hardening, the more likely result may be fetchmail authentication failure or a process abort.
What version contains the fix?
The issue is fixed in fetchmail 6.6.7.