Fetchmail Denial-of-Service Vulnerability in SMTP Authentication

A denial-of-service vulnerability has been identified in Fetchmail versions prior to 6.5.6. When the SMTP client authenticates and receives a 334 status code in a malformed context, Fetchmail can crash. This issue arises because the client attempts to read from a memory location that is not under the attacker's control, leading to a crash. If Fetchmail is running in daemon mode, this mode will also terminate due to the crash.

Impact

Exploiting this vulnerability causes Fetchmail to crash, including any active daemon processes, which can disrupt mail retrieval and delivery operations.

Remediation

Users can upgrade to Fetchmail version 6.5.6 or newer. The Fetchmail source code is available on SourceForge and GitLab. Alternatively, the specific patch for this vulnerability can be applied and Fetchmail can be rebuilt.