Описание
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
Affects v5.0.8 through v6.6.6.
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
Отчет
While the underlying stack-based buffer overflow in fetchmail's NTLM authentication handling is present in the source code, the compiler's stack variable layout in these builds places the vulnerable buffer adjacent to a larger variable that absorbs the overflow before it can reach the stack canary or return address. As a result, triggering this flaw in any Red Hat-shipped build does not lead to remote code execution; the observed effect is a corrupted NTLM negotiation flag that causes authentication to fail. Red Hat recommends customers update to a fixed fetchmail package when it becomes available as a defense-in-depth measure, even though exploitation for code execution has not been demonstrated on shipped builds.
Меры по смягчению последствий
Rebuild fetchmail without --enable-NTLM (omit NTLM at configure time). Confirm with fetchmail -V that the build does not list +NTLM.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | fetchmail | Affected | ||
| Red Hat Enterprise Linux 7 | fetchmail | Affected | ||
| Red Hat Enterprise Linux 10 | fetchmail | Fixed | RHSA-2026:85959 | 20.10.2026 |
| Red Hat Enterprise Linux 8 | fetchmail | Fixed | RHSA-2026:86982 | 21.10.2026 |
| Red Hat Enterprise Linux 9 | fetchmail | Fixed | RHSA-2026:86981 | 21.10.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
A stack-based buffer overflow flaw was found in fetchmail when built w ...
EPSS
5.3 Medium
CVSS3