It was discovered that camel's NTLM SASL authentication mechanism did not properly validate server's challenge packets (NTLM authentication type 2 packets, [1]). In the ntlmchallenge() in camel/camel-sasl-ntlm.c, length of the domain string that was copied from type 2 to type 3 packet (client's reply to server's challenge) was not properly validated against the rest of the data received from the server.

127 ntlmsetstring (ret, NTLMRESPONSEDOMAINOFFSET, 128 token->data + NTLMCHALLENGEDOMAINOFFSET, 129 atoi (token->data + NTLMCHALLENGEDOMAINLENOFFSET));

Server could specify larger length than the actual data sent in the packet, causing the client to disclose portion of its memory, or crash.

Note: length value was not properly extracted from the packet too, as it is not passed as string, rather as 16-bit LE value.

[1] http://curl.haxx.se/rfc/ntlm.html#theType2Message