-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fetchmail-SA-2026-01: --enable-NTLM potential remote code execution

Topics:         Possible remote code execution from a rogue server
                through stack buffer overflow in NTLM authentication method,
                depending on build details including compiler, ABI, call
                conventions, and compiler flags.

Author:         Matthias Andree
Version:        1.2
Announced:      2026-06-27, revised 2026-09-22
Type:           failure to validate network input in certain configurations
Impact:         attacker may write a few dozen bytes on stack
Severity:       - high if built with NTLM enabled, depending on build details
                - unaffected if NTLM disabled during build, or if
                  the build itself is non-vulnerable (which cannot be stated
                  generally in a concise way as it depends on many details)
Credit:         - Tristan Madani (report and discussion)
                - Red Hat CNA for CVE Id
                  via https://bugzilla.redhat.com/show_bug.cgi?id=2531984

URL:            https://www.fetchmail.info/fetchmail-SA-2026-01.txt
Project URL:    https://www.fetchmail.info/
CVE Id:         CVE-2026-94184 (via Red Hat CNA)
CWE Id:         CWE-121 stack based buffer overflow

Affected:       - fetchmail releases 5.0.8 up to and including 6.6.6
                - fetchmail releases 7.0.0-alpha before/excluding -alpha11

Not affected:   - fetchmail release candidate 6.6.7.rc1 and subsequent releases
Not affected:   - fetchmail alpha 7.0.0-alpha11 or newer (dropped NTLM support)

Introduced in:  1999-09-14 fetchmail release 5.0.8, which added NTLM

First
Corrected in:   2026-06-26 Git commit cb5be5c38471eec19e519ace0bc569176317ea92
                2026-06-27 fetchmail release candidates 6.6.7.rc1 and later,
                fetchmail release 6.6.7

Context:        https://bugzilla.redhat.com/show_bug.cgi?id=2531984
                https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117136

History:        1.2 2026-09-22 added CVE Id, CVSS v3.1, revised
                    2026-09-11 removed SMTP-related part from section 3.
                1.1 2026-09-11 revised, vulnerable with certain compilers
                1.0 2026-07-23 revised announcement, revoked vulnerability
                0.9 2026-06-27 separate announcement mailed
                    2024-11-13 fetchmail 6.5.1 started discouraging NTLM use


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP3, IMAP, ETRN
or ODMR servers and forward it to local SMTP, LMTP servers, or message delivery
agents.

fetchmail can be configured at build time with --enable-NTLM to support
SASL authentication via the NTLM method.  This will be attempted automatically
on all servers that advertise it, unless a specific other authentication
method is configured.

fetchmail has discouraged use of NTLM at configure time since release 6.5.1
in November 2024, but some distributors may package fetchmail in a way
that it supports NTLM still.


2a. Problem description and Impact
==================================

The NTLM authentication scheme is a three-part challenge-response scheme that
consists of 1 - a negotiate message ("request"), 2 - a challenge message,
3 - an authenticate message ("response"), where the parenthesized text shows
how fetchmail's source code names the object variables.
1 and 3 are generated by the client, fetchmail, and 2 by the server.

When fetchmail builds the authenticate message in buildSmbNtlmAuthReponse,
it uses an internal macro AddBytes to transfer data from the received
challenge message (2) into the buffer holding the authenticate response,
which in extreme cases can cause fetchmail to overwrite the output buffer,
which was allocated as C array on the stack, by several dozen bytes.
  The root cause is insufficient validation of the remaining destination
buffer capacity before triggering a copy of data.

Tristan Madani pointed out, after the 6.6.7 release, that there is no control
as to how builds lay out the array variables on the stack, yet if this is
exploitable depends on the exact layout of the stack frame of the ntlm_helper
function and what calling convention and target ABI apply.
  Fetchmail's 6.6.7 release and its release candidate all contain the same
fix to eliminate this vulnerability, but the NEWS and fetchmail-SA-2026-01.txt
files shipping in the 6.6.7 release were both denying a risk, which was
inaccurate. Fetchmail 6.6.8 will correct these files.

  Compilers have a certain freedom as to where to place what variables,
the source code does not specify a certain order of them.
  A malicious server can cause fetchmail to overwrite several dozen bytes of
memory in vulnerable builds, but the general assessment of impact depends on
many variables.  Worst case, the code is vulnerable to remote code execution,
in other cases, it may be vulnerable to denial of service by causing fetchmail
to be terminated in the error situation.


2b. Assessing the vulnerability risk
====================================

This is hard because it is highly dependent on many variables that vary
among target systems. This document will state the worst-case score.

Exact build results, ABI, variable layout, additional hardening options
may reduce or eliminate the risk, but depends on too many variables to
assess generally.

The WORST case then yields a CVSS v3.1 temporal vector of
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C with these scores

(CVSS v3.1 per NVD's calculator as of 2026-09-22):
CVSS Base Score:                8.1
Impact Subscore:                5.9
Exploitability Subscore:        2.2
CVSS Temporal Score:            7.1
CVSS Environmental Score:       7.1
Modified Impact Subscore:       5.9
Overall CVSS Score:             7.1


3. Solution
===========

Update to fetchmail release 6.6.7 or 6.6.8.  The fixed versions will check
the remaining "response" buffer size to only copy data if there is sufficient
space, or otherwise reject the copy and instead give a clear error message that
the internal buffer is insufficiently sized without overflowing it.

Fetchmail 6.6.8 ships an updated version of this security announcement,
a corrected NEWS file, and adds translated message files to the install.

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about malfunctions of all kinds.


4. Workaround
=============

Recompile and reinstall fetchmail WITHOUT options/configuration that would
enable NTLM, i. e. omit the --enable-NTLM option on the ./configure command
line, and do not enable them via modification of header files.



A. Copyright, License and Non-Warranty
======================================

(C) Copyright 2026 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2026-01
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmqy51cACgkQ5BKxVu/z
hVqbHg//QOcxhFVz93MgYiABJKSnE9w2psHQAq6nWdXVKk4JIgQNG6HIt7bD5I7c
9kQXqhM5W0dRKbEzOANuu5aNd4wnW/D6p1m96zYNSzV+v09ZwvEKPIKK/aupDhaz
OIKA9iCzcJL8GuEoS+TNudD/VioBYQRJcTOXhxRP3syNf/5p+H6gCgnn36TtVhDM
YjOytozVE1SkXN+xJ2hZmu/rWIZ+TcnKDbQ6/vKGcIsn+Z4QkG1cndSu4ARz/+ba
Jf21dkIsP2YNgQPt21gQLS5OsewpuPZZsdPt9AL7a+WE8V9GfcH7CkZt5GnktNVv
7+wOHMrrSASgf60FLoeExp7TPtofWmlGMkXFlbwFok+O6oeRCyqtWBsmOGk32oxA
0Lr4wxMnBoFydTJAVRm87GCuU+FE+KhnOnkirfjnBZvUTiG4mHtPE0dA0LLi8ZFW
esBWpIGDaKJTdVQas8xzuVZH7yQRihu1IRgl5pHXmLpVN+bs34d5dmDoigt6k+zq
OKgqRCTwbPyqsNTCvUc6TKfhAlKPuhzYW63a+WOe7Jh0OfDS480aA4PViz78NMd6
Q0XSmlfDVDGI+JGwoqHwzhVLDgXeZzu3UHHZN9xVDEbbjbIjmhMKfNHDJ17JdZE8
is9oew9QIL1yEWy54GQhTCCNKuWMxbzvSoplM4YrGiJjSpPheL0=
=frBn
-----END PGP SIGNATURE-----
