-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 fetchmail-SA-2026-01: --enable-NTLM potential remote code execution Topics: Possible remote code execution from a rogue server through stack buffer overflow in NTLM authentication method, depending on build details including compiler, ABI, call conventions, and compiler flags. Author: Matthias Andree Version: 1.3 Announced: 2026-06-27, revised 2026-09-23 Type: failure to validate network input in certain configurations Impact: attacker may write a few dozen bytes on stack Severity: - high if built with NTLM enabled, depending on build details - unaffected if NTLM disabled during build, or if the build itself is non-vulnerable (which cannot be stated generally in a concise way as it depends on many details) Credit: - Tristan Madani (report and discussion) - Red Hat CNA for CVE Id via https://bugzilla.redhat.com/show_bug.cgi?id=2531984 URL: https://www.fetchmail.info/fetchmail-SA-2026-01.txt Project URL: https://www.fetchmail.info/ CVE Id: CVE-2026-94184 (via Red Hat CNA) CWE Id: CWE-121 stack based buffer overflow Affected: - fetchmail releases 5.0.8 up to and including 6.6.6 - fetchmail releases 7.0.0-alpha before/excluding -alpha11 Not affected: - fetchmail release candidate 6.6.7.rc1 and subsequent releases Not affected: - fetchmail alpha 7.0.0-alpha11 or newer (dropped NTLM support) Introduced in: 1999-09-14 fetchmail release 5.0.8, which added NTLM First Corrected in: 2026-06-26 Git commit cb5be5c38471eec19e519ace0bc569176317ea92 2026-06-27 fetchmail release candidates 6.6.7.rc1 and later, fetchmail release 6.6.7 Context: https://bugzilla.redhat.com/show_bug.cgi?id=2531984 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148731 History: 1.3 2ß26-09-23 corrected Debian Bug reference 1.2 2026-09-22 added CVE Id, CVSS v3.1, revised 2026-09-11 removed SMTP-related part from section 3. 1.1 2026-09-11 revised, vulnerable with certain compilers 1.0 2026-07-23 revised announcement, revoked vulnerability 0.9 2026-06-27 separate announcement mailed 2024-11-13 fetchmail 6.5.1 started discouraging NTLM use 1. Background ============= fetchmail is a software package to retrieve mail from remote POP3, IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers, or message delivery agents. fetchmail can be configured at build time with --enable-NTLM to support SASL authentication via the NTLM method. This will be attempted automatically on all servers that advertise it, unless a specific other authentication method is configured. fetchmail has discouraged use of NTLM at configure time since release 6.5.1 in November 2024, but some distributors may package fetchmail in a way that it supports NTLM still. 2a. Problem description and Impact ================================== The NTLM authentication scheme is a three-part challenge-response scheme that consists of 1 - a negotiate message ("request"), 2 - a challenge message, 3 - an authenticate message ("response"), where the parenthesized text shows how fetchmail's source code names the object variables. 1 and 3 are generated by the client, fetchmail, and 2 by the server. When fetchmail builds the authenticate message in buildSmbNtlmAuthReponse, it uses an internal macro AddBytes to transfer data from the received challenge message (2) into the buffer holding the authenticate response, which in extreme cases can cause fetchmail to overwrite the output buffer, which was allocated as C array on the stack, by several dozen bytes. The root cause is insufficient validation of the remaining destination buffer capacity before triggering a copy of data. Tristan Madani pointed out, after the 6.6.7 release, that there is no control as to how builds lay out the array variables on the stack, yet if this is exploitable depends on the exact layout of the stack frame of the ntlm_helper function and what calling convention and target ABI apply. Fetchmail's 6.6.7 release and its release candidate all contain the same fix to eliminate this vulnerability, but the NEWS and fetchmail-SA-2026-01.txt files shipping in the 6.6.7 release were both denying a risk, which was inaccurate. Fetchmail 6.6.8 will correct these files. Compilers have a certain freedom as to where to place what variables, the source code does not specify a certain order of them. A malicious server can cause fetchmail to overwrite several dozen bytes of memory in vulnerable builds, but the general assessment of impact depends on many variables. Worst case, the code is vulnerable to remote code execution, in other cases, it may be vulnerable to denial of service by causing fetchmail to be terminated in the error situation. 2b. Assessing the vulnerability risk ==================================== This is hard because it is highly dependent on many variables that vary among target systems. This document will state the worst-case score. Exact build results, ABI, variable layout, additional hardening options may reduce or eliminate the risk, but depends on too many variables to assess generally. The WORST case then yields a CVSS v3.1 temporal vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C with these scores (CVSS v3.1 per NVD's calculator as of 2026-09-22): CVSS Base Score: 8.1 Impact Subscore: 5.9 Exploitability Subscore: 2.2 CVSS Temporal Score: 7.1 CVSS Environmental Score: 7.1 Modified Impact Subscore: 5.9 Overall CVSS Score: 7.1 3. Solution =========== Update to fetchmail release 6.6.7 or 6.6.8. The fixed versions will check the remaining "response" buffer size to only copy data if there is sufficient space, or otherwise reject the copy and instead give a clear error message that the internal buffer is insufficiently sized without overflowing it. Fetchmail 6.6.8 ships an updated version of this security announcement, a corrected NEWS file, and adds translated message files to the install. General recommendation: if running fetchmail in the background or in daemon mode, ensure that the daemon is supervised and crashes are reported so that action can be taken about malfunctions of all kinds. 4. Workaround ============= Recompile and reinstall fetchmail WITHOUT options/configuration that would enable NTLM, i. e. omit the --enable-NTLM option on the ./configure command line, and do not enable them via modification of header files. A. Copyright, License and Non-Warranty ====================================== (C) Copyright 2026 by Matthias Andree, . Some rights reserved. This file is licensed under CC BY-ND 4.0. To view a copy of this license, visit THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES. Use the information herein at your own risk. END of fetchmail-SA-2026-01 -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmq0L6oACgkQ5BKxVu/z hVqN7A//QOXKimKMZ8HLiu4MCxn6/rgXkLVkksEtH5FvfGN73ZZxcefswoGbqMDv jG4U+DDmVWjXeHRx9nlBU69ReXKTA74GPY4EdweqXzvzrq134A004yJhgrfyCnU1 hyw7KtFcx/70+ONega1838Nt3crWXH0tOhnpoJOYSXBnteuhlf6CQjasn3Sa1ehw ague1iyojJFrr4KO/nNdI8uOlEDRx7o3AqU2Z4a0OA4EXF0RDTLHM1yF7IRO+I0H 6e8BueMP61UKByrAQIRIN0ZZZ2n0Duy7efMIrkVYF1whhLzWNqGDdWjX5ez36b5Z 6bLBGkXiQBmlevM3WxsGO1PuOL0ZIjINjnpzUOjG1Mcc677n3NeTpK11oKKCAJhq Qja/qfvdlJ/QKuRIZhP1nJLMns47X6/gLBIGagZXp3U72PNp59klF4GdWmgmJXVV On74/O+LhfHyLLCSk7QsBLz3ybJ6sXCbWWV1TPUEt4MWOnXR8nMK8yg14K1WCYSq Lcebr/O/70tdeVT5vWRVGi6le4XHglfHEVkDJOPzWpCuu4rif8FBf3mmua8ZWuTh SWIUHloioL1Xtw2T6AS9qSYWheLI0klAe/wzGCdYy4JwoNg6JoA3LnUetpPljExA tmRx3UnR/1EQF3JXmu5Ze68x6VDIaupEMdZf2T1B3tZCzhkGDEM= =XF5O -----END PGP SIGNATURE-----