In GNU gsasl versions prior to 2.2.4, the NTLM client implementation in _gsasl_ntlm_client_step() does not properly initialize memory when processing a Type-2 challenge from a server. A malicious NTLM server can send a short challenge, leaving the remaining bytes of the allocated struct uninitialized. These uninitialized bytes are later read and included in the NTLM response sent to the server, disclosing heap memory contents.
| Vendor | Product | Versions |
|---|---|---|
| gnu | gsasl | < 2.2.4 |
