Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sambaUpgrade heimdal | Sep 20, 2017 | Jul 13, 2017 |
| Apple Osx Heimdal | — | Apply OS X security update 2017-001 SierraUpgrade macOS to the latest versionApply OS X security update 2017-004 El Capitan | Sep 26, 2017 | Jul 13, 2017 |
| Debian | — | Upgrade sambaUpgrade heimdal | Jul 15, 2017 | Jul 12, 2017 |
| Freebsd | — | Upgrade samba43Upgrade samba44Upgrade samba42Upgrade samba45Upgrade samba46 | Jul 13, 2017 | Jul 12, 2017 |
| Hpux | — | Update CIFS-Server to the latest version | Mar 28, 2022 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-winbind-modulesUpgrade libsmbclientUpgrade samba-common-libsUpgrade samba-winbind-clientsUpgrade samba-winbindUpgrade libwbclientUpgrade samba-commonUpgrade samba-pythonUpgrade sambaUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-client-libsUpgrade samba-libs | Feb 22, 2021 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-common-libsUpgrade samba-clientUpgrade sambaUpgrade samba-winbindUpgrade libsmbclientUpgrade samba-commonUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade samba-pythonUpgrade samba-winbind-clientsUpgrade samba-libsUpgrade samba-client-libsUpgrade libwbclient | Sep 28, 2020 | Jul 13, 2017 |
| Samba | — | Upgrade to Samba version 4.4.15Upgrade to Samba version 4.5.12Upgrade to Samba version 4.6.6 | Jul 17, 2017 | Jul 13, 2017 |
| Suse | — | Upgrade libsamba-credentials-develUpgrade libsamba-policy0Upgrade libndr-nbt0Upgrade libsmbconf0Upgrade libndr1-32bitUpgrade samba-cephUpgrade samba-winbind-32bitUpgrade ldirectordUpgrade libndr-standard0-32bitUpgrade libndr-nbt0-32bitUpgrade libsmbldap-develUpgrade libtevent-util0-32bitUpgrade samba-winbindUpgrade libndr-krb5pac0Upgrade libsmbldap2-32bitUpgrade samba-libs-python3-32bitUpgrade libndr-develUpgrade libdcerpc-develUpgrade libnetapi0Upgrade samba-libs-python3Upgrade samba-docUpgrade libndr-krb5pac-develUpgrade samba-dsdb-modulesUpgrade libwbclient0-32bitUpgrade monitoring-plugins-metadataUpgrade libsamdb0Upgrade libsamba-passdb0-32bitUpgrade resource-agentsUpgrade libwbclient-develUpgrade libsmbconf0-32bitUpgrade libndr0Upgrade samba-pythonUpgrade libtevent-util0Upgrade libdcerpc-binding0Upgrade libsamba-hostconfig0-32bitUpgrade libsmbldap0Upgrade libsamba-errors0Upgrade samba-python3Upgrade sambaUpgrade samba-core-develUpgrade libsamba-passdb-develUpgrade samba-kdcUpgrade libsamba-errors-develUpgrade samba-clientUpgrade libsamba-policy-develUpgrade libsmbldap2Upgrade libsamba-credentials0-32bitUpgrade libsamdb0-32bitUpgrade libsamba-hostconfig-develUpgrade libndr-standard-develUpgrade libnetapi0-32bitUpgrade libndr1Upgrade libsamba-util0Upgrade libdcerpc-samr-develUpgrade libsamba-util-develUpgrade libndr0-32bitUpgrade libsamba-errors0-32bitUpgrade libdcerpc0Upgrade samba-libs-32bitUpgrade libdcerpc-samr0Upgrade libsamba-policy0-python3Upgrade libsamba-passdb0Upgrade libdcerpc-binding0-32bitUpgrade libsamba-util0-32bitUpgrade libsamdb-develUpgrade libnetapi-develUpgrade libsmbclient-develUpgrade samba-libsUpgrade libwbclient0Upgrade libsamba-hostconfig0Upgrade libsmbclient0-32bitUpgrade libsamba-credentials0Upgrade libdcerpc0-32bitUpgrade libsmbconf-develUpgrade libndr-nbt-develUpgrade samba-client-32bitUpgrade libndr-krb5pac0-32bitUpgrade libsmbclient0Upgrade ctdbUpgrade libtevent-util-develUpgrade libndr-standard0Upgrade libsamba-policy-python3-develUpgrade libsmbldap0-32bit | Aug 17, 2017 | Jul 12, 2017 |
| Ubuntu | — | Upgrade samba-libsUpgrade libkrb5-26-heimdalUpgrade libsmbclient | Jul 15, 2017 | Jul 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub