Index: fetchmail-6.3.9-rc2/Makefile.am
===================================================================
--- fetchmail-6.3.9-rc2.orig/Makefile.am
+++ fetchmail-6.3.9-rc2/Makefile.am
@@ -68,7 +68,7 @@ fetchmail_SOURCES=	fetchmail.h getopt.h
 		uid.c mxget.c md5ify.c cram.c gssapi.c \
 		opie.c interface.c netrc.c \
 		unmime.c conf.c checkalias.c \
-		lock.h lock.c \
+		lock.h lock.c ntlmsubr.c\
 		rcfile_l.l rcfile_y.y ucs/norm_charmap.c
 if POP2_ENABLE
 fetchmail_SOURCES += pop2.c
Index: fetchmail-6.3.9-rc2/imap.c
===================================================================
--- fetchmail-6.3.9-rc2.orig/imap.c
+++ fetchmail-6.3.9-rc2/imap.c
@@ -228,57 +228,13 @@ static int imap_ok(int sock, char *argbu
 
 static int do_imap_ntlm(int sock, struct query *ctl)
 {
-    tSmbNtlmAuthRequest request;
-    tSmbNtlmAuthChallenge challenge;
-    tSmbNtlmAuthResponse response;
-
-    char msgbuf[2048];
-    int result,len;
+    int result;
 
     gen_send(sock, "AUTHENTICATE NTLM");
 
-    if ((result = gen_recv(sock, msgbuf, sizeof msgbuf)))
+    if ((result = ntlm_helper(sock, ctl, "IMAP")))
 	return result;
   
-    if (msgbuf[0] != '+')
-	return PS_AUTHFAIL;
-  
-    buildSmbNtlmAuthRequest(&request,ctl->remotename,NULL);
-
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthRequest(stdout, &request);
-
-    memset(msgbuf,0,sizeof msgbuf);
-    to64frombits (msgbuf, &request, SmbLength(&request));
-  
-    if (outlevel >= O_MONITOR)
-	report(stdout, "IMAP> %s\n", msgbuf);
-  
-    strcat(msgbuf,"\r\n");
-    SockWrite (sock, msgbuf, strlen (msgbuf));
-
-    if ((gen_recv(sock, msgbuf, sizeof msgbuf)))
-	return result;
-  
-    len = from64tobits (&challenge, msgbuf, sizeof(challenge));
-    
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthChallenge(stdout, &challenge);
-    
-    buildSmbNtlmAuthResponse(&challenge, &response,ctl->remotename,ctl->password);
-  
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthResponse(stdout, &response);
-  
-    memset(msgbuf,0,sizeof msgbuf);
-    to64frombits (msgbuf, &response, SmbLength(&response));
-
-    if (outlevel >= O_MONITOR)
-	report(stdout, "IMAP> %s\n", msgbuf);
-      
-    strcat(msgbuf,"\r\n");
-    SockWrite (sock, msgbuf, strlen (msgbuf));
-  
     result = imap_ok (sock, NULL);
     if (result == PS_SUCCESS)
 	return PS_SUCCESS;
Index: fetchmail-6.3.9-rc2/ntlmsubr.c
===================================================================
--- /dev/null
+++ fetchmail-6.3.9-rc2/ntlmsubr.c
@@ -0,0 +1,88 @@
+#include "config.h"
+
+#ifdef NTLM_ENABLE
+#include "fetchmail.h"
+#include "i18n.h"
+#include "ntlm.h"
+#include "socket.h"
+
+#include <string.h>
+
+int ntlm_helper(int sock, struct query *ctl, const char *proto)
+{
+/*
+ * NTLM support by Grant Edwards.
+ *
+ * Handle MS-Exchange NTLM authentication method.  This is the same
+ * as the NTLM auth used by Samba for SMB related services. We just
+ * encode the packets in base64 instead of sending them out via a
+ * network interface.
+ *
+ * Much source (ntlm.h, smb*.c smb*.h) was borrowed from Samba.
+ */
+    tSmbNtlmAuthRequest request;
+    tSmbNtlmAuthChallenge challenge;
+    tSmbNtlmAuthResponse response;
+
+    char msgbuf[2048];
+    int result;
+
+    if ((result = gen_recv(sock, msgbuf, sizeof msgbuf)))
+	return result;
+
+    if (msgbuf[0] != '+' && strspn(msgbuf+1, " \t") < strlen(msgbuf+1)) {
+	if (outlevel >= O_VERBOSE) {
+	    report(stdout, GT_("Warning: received malformed challenge to \"AUTH(ENTICATE) NTLM\"!\n"));
+	}
+	result = PS_AUTHFAIL;
+	goto cancelfail;
+    }
+
+    buildSmbNtlmAuthRequest(&request,ctl->remotename,NULL);
+
+    if (outlevel >= O_DEBUG)
+	dumpSmbNtlmAuthRequest(stdout, &request);
+
+    memset(msgbuf,0,sizeof msgbuf);
+    to64frombits (msgbuf, &request, SmbLength(&request));
+
+    if (outlevel >= O_MONITOR)
+	report(stdout, "%s> %s\n", proto, msgbuf);
+
+    strcat(msgbuf,"\r\n");
+    SockWrite (sock, msgbuf, strlen (msgbuf));
+
+    if ((result = gen_recv(sock, msgbuf, sizeof msgbuf)))
+	goto cancelfail;
+
+    (void)from64tobits (&challenge, msgbuf, sizeof(challenge));
+
+    if (outlevel >= O_DEBUG)
+	dumpSmbNtlmAuthChallenge(stdout, &challenge);
+
+    buildSmbNtlmAuthResponse(&challenge, &response,ctl->remotename,ctl->password);
+
+    if (outlevel >= O_DEBUG)
+	dumpSmbNtlmAuthResponse(stdout, &response);
+
+    memset(msgbuf,0,sizeof msgbuf);
+    to64frombits (msgbuf, &response, SmbLength(&response));
+
+    if (outlevel >= O_MONITOR)
+	report(stdout, "%s> %s\n", proto, msgbuf);
+
+    strcat(msgbuf,"\r\n");
+    SockWrite (sock, msgbuf, strlen (msgbuf));
+
+    return PS_SUCCESS;
+
+cancelfail: /* cancel authentication and return failure */
+    {
+	if (outlevel >= O_MONITOR)
+	    report(stdout, "%s> *\n", proto);
+	SockWrite(sock, "*\r\n", 3);
+	return result;
+    }
+}
+
+#endif /* NTLM_ENABLE */
Index: fetchmail-6.3.9-rc2/pop3.c
===================================================================
--- fetchmail-6.3.9-rc2.orig/pop3.c
+++ fetchmail-6.3.9-rc2/pop3.c
@@ -82,57 +82,14 @@ char *sdps_envto;
 static int do_pop3_ntlm(int sock, struct query *ctl,
 	int msn_instead /** if true, send AUTH MSN, else send AUTH NTLM */)
 {
-    tSmbNtlmAuthRequest request;
-    tSmbNtlmAuthChallenge challenge;
-    tSmbNtlmAuthResponse response;
-
-    char msgbuf[2048];
-    int result,len;
+    char msgbuf[POPBUFSIZE+1];
+    int result;
   
     gen_send(sock, msn_instead ? "AUTH MSN" : "AUTH NTLM");
 
-    if ((result = gen_recv(sock, msgbuf, sizeof msgbuf)))
+    if ((result = ntlm_helper(sock, ctl, "POP3")))
 	return result;
   
-    if (msgbuf[0] != '+')
-	return PS_AUTHFAIL;
-  
-    buildSmbNtlmAuthRequest(&request,ctl->remotename,NULL);
-
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthRequest(stdout, &request);
-
-    memset(msgbuf,0,sizeof msgbuf);
-    to64frombits (msgbuf, &request, SmbLength(&request));
-  
-    if (outlevel >= O_MONITOR)
-	report(stdout, "POP3> %s\n", msgbuf);
-  
-    strcat(msgbuf,"\r\n");
-    SockWrite (sock, msgbuf, strlen (msgbuf));
-
-    if ((gen_recv(sock, msgbuf, sizeof msgbuf)))
-	return result;
-  
-    len = from64tobits (&challenge, msgbuf, sizeof(msgbuf));
-    
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthChallenge(stdout, &challenge);
-    
-    buildSmbNtlmAuthResponse(&challenge, &response,ctl->remotename,ctl->password);
-  
-    if (outlevel >= O_DEBUG)
-	dumpSmbNtlmAuthResponse(stdout, &response);
-  
-    memset(msgbuf,0,sizeof msgbuf);
-    to64frombits (msgbuf, &response, SmbLength(&response));
-
-    if (outlevel >= O_MONITOR)
-	report(stdout, "POP3> %s\n", msgbuf);
-      
-    strcat(msgbuf,"\r\n");
-    SockWrite (sock, msgbuf, strlen (msgbuf));
-  
     if ((result = gen_recv (sock, msgbuf, sizeof msgbuf)))
 	return result;
   
