-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

fetchmail-SA-2025-01: SMTP AUTH denial of service

Topics:		fetchmail SMTP client can crash when authenticating

Author:		Matthias Andree
Version:	1.1
Announced:	2025-10-03
Type:		failure to validate network input in certain configurations
Impact:		fetchmail tries to read from address 1 and can crash
Severity:	moderate

URL:		https://www.fetchmail.info/fetchmail-SA-2025-01.txt
Project URL:	https://www.fetchmail.info/
CVE Name:	CVE-2025-61962

Affects:	- fetchmail releases up to and including 6.5.5
		- fetchmail 7.0.0 pre-releases

Not affected:	- fetchmail 6.5 releases 6.5.6 and newer

Introduced in:	2002-03-09 fetchmail release 5.9.9 added SMTP AUTH

Corrected in:	2025-10-03 Git commit 4c3cebfa4e659fb778ca2cae0ccb3f69201609a8
		2025-10-03 fetchmail release 6.5.6

History:	1.0 2025-10-03 initial announcement
		1.1 2025-10-04 CVE ID added above


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail defaults to using the SMTP server on "localhost"
and to not attempting to authenticate, unless configured otherwise.

fetchmail also supports a "daemon" mode, where it runs over extended time
and periodically polls the upstream servers.  This can detach fetchmail
from the controlling terminal into the background, or - with a "nodetach" setting
- - keep attached to the controlling terminal, which also eases use by
service supervisors.


2. Problem description and Impact
=================================

fetchmail's SMTP client, when configured to authenticate [1], is susceptible
to a protocol violation where, when a trusted but malicious or malfunctioning
SMTP server responds to an authentication request with a "334" code but without a
following blank on the line, it will attempt to start reading from memory
address 0x1 to parse the server's SASL challenge. This address is constant and not
under the attacker's control. This event will usually cause a crash of fetchmail.
  If fetchmail in this situation was running in daemon mode, this mode is also
terminated by the crash.

[1] This requires the esmtpname and esmtppassword options to be configured in
the configuration file and the plugout and mda options to be inactive.

As a word of warning, this vulnerability has eluded several static code analyzers.


3. Solutions
============

General recommendation: if running fetchmail in the background or in daemon
mode, ensure that the daemon is supervised and crashes are reported so that
action can be taken about the malfunctioning SMTP server, or on fetchmail's end
to replace local delivery by different server or other means.


3a. Install fetchmail 6.5.6 or newer.

The fetchmail source code is available from
<https://sourceforge.net/projects/fetchmail/files/> and
<https://gitlab.com/fetchmail/fetchmail/-/releases>

The Git-based source code repository is currently published via
https://gitlab.com/fetchmail/fetchmail/-/tree/legacy_6x (primary)
https://sourceforge.net/p/fetchmail/git/ci/legacy_6x/tree/ (copy)


3b. Apply the smtp.c patch from the URL below and rebuild fetchmail:
<https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0ccb3f69201609a8>


A. Copyright, License and Non-Warranty
======================================

(C) Copyright 2025 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This file is licensed under CC BY-ND 4.0. To view a copy of this license,
visit <http://creativecommons.org/licenses/by-nd/4.0/>

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2025-01
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmjg5+8ACgkQ5BKxVu/z
hVqZIBAAx6BZ5MdHlCgX7vVQnqw2YkSq+IX03jkQOjnMygANkm6IvqfIGJcZojN6
87ks3Rc/88jAY57fyLYRr3TZglweVrP74QivvWCWdOXYsAel8vYsS+WsSwHrzO4L
/EeFqaqxn3OSa5n3Y/xMVk/U+runNenaXlHOy81Aj8ad60kMmSTwEj1zVgQnMVR+
a8vutwjYp8L5lUBBZz3hofQZqKKZnI+6JV5AsbYuzNXsAoEH31tahbDe0WfJUtvd
Twqz/YTf278xD/xU6NNS3t93gPYRfGDlSbxz+LM8lrMgzZTvtHpHRpt+BZJnUZKM
dQtZSEbgIaO7vslx4sJli1yrkwTY/QZyFwYLepQw14ByWTqPn9Eb8pzEI0sbmhXn
O5fcUIVHOOkvmV6/KE8cC5pymTnSxAzGHbUxLdUjCyIKnVMQPKrBAFeCKJQM5OH+
9fv+SgGrDD+hmQQZA0B5yBFGaAch3hDy86IF0P4VJPR9m5zK8xnQr6EketZ2Fh0O
5z+1Hxp2LQvpnw/30EL82yfEUFH0nfkzFFhwZKZjr+JOfLutCMULgnF8wkAqSJvP
gOGRvbFTnQDGlKlrM0hxNUuTRQFZJ3vkJ3AclOzwm3cnw5o4PmqBPA4+kdv22BRl
J6pgV+EQp91YetF9YCIFrsBYRVyau0JDUN20n/TczN0dyXWUa+g=
=P3Cg
-----END PGP SIGNATURE-----
