AI analysis
fetchmail, when compiled with NTLM support, contains a stack-based buffer overflow (CWE-121) in the code that constructs the NTLM authenticate response while parsing a server-supplied Type 2 challenge. A malicious or compromised POP3/IMAP mail server that advertises NTLM authentication can trigger the overflow during the authentication handshake, writing past a fixed stack buffer before any mail is transferred. Depending on stack-frame layout, this can yield remote code execution in the fetchmail process; on memory-hardened builds it more likely causes authentication failure or a crash (denial of polling). The CVSS 3.1 score is 8.1 (high) with network vector and no privileges or user interaction required, though attack complexity is high because the attacker must control or have compromised the mail server that fetchmail polls. There is no public proof of concept, the flaw is not in the CISA KEV catalog, and no exploitation has been observed in the wild.
What to do: Apply your distribution's patched fetchmail package as soon as vendor errata are released — the advisory does not name a fixed version, so track your vendor's security tracker. As an immediate mitigation, disable NTLM by setting an explicit authentication method in .fetchmailrc (e.g., 'auth password', or kerberos_v5/gssapi) and audit all configs for 'auth ntlm' or 'auth ntlm_v2', which engage the vulnerable Type 2 parsing path. Prioritize deployments polling third-party or less-trusted mail providers (where the server could be hostile or compromised), and run fetchmail under a dedicated unprivileged account with ASLR and stack-protector hardening so that any overflow degrades to a crash rather than code execution.
Affected
| The fetchmail Project fetchmail | — |
Estimated exposure
large≈100,000–1,000,000 installations worldwide (order of 10^5), primarily Linux/BSD servers, mail gateways, hosting control panels, and NAS devices — fetchmail ships in every major Linux distribution's repositories and is commonly bundled in NAS and embedded products and hosting stacks, but because it runs as a client polling mail servers rather than as a listening service, it has no…
Description
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.