Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdalUpgrade samba | Sep 20, 2017 | Jul 13, 2017 |
| Apple Osx Heimdal | — | Apply OS X security update 2017-001 SierraUpgrade macOS to the latest versionApply OS X security update 2017-004 El Capitan | Sep 26, 2017 | Jul 13, 2017 |
| Debian | — | Upgrade sambaUpgrade heimdal | Jul 15, 2017 | Jul 12, 2017 |
| Freebsd | — | Upgrade samba43Upgrade samba44Upgrade samba45Upgrade samba46Upgrade samba42 | Jul 13, 2017 | Jul 12, 2017 |
| Hpux | — | Update CIFS-Server to the latest version | Mar 28, 2022 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-common-libsUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-libsUpgrade samba-commonUpgrade samba-winbind-clientsUpgrade samba-client-libsUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-pythonUpgrade sambaUpgrade libwbclient | Feb 22, 2021 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libwbclientUpgrade samba-client-libsUpgrade samba-libsUpgrade samba-winbind-modulesUpgrade samba-commonUpgrade samba-winbind-clientsUpgrade samba-common-libsUpgrade sambaUpgrade samba-winbindUpgrade samba-pythonUpgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-client | Sep 28, 2020 | Jul 13, 2017 |
| Samba | — | Upgrade to Samba version 4.5.12Upgrade to Samba version 4.6.6Upgrade to Samba version 4.4.15 | Jul 17, 2017 | Jul 13, 2017 |
| Suse | — | Upgrade libsamba-passdb-develUpgrade samba-kdcUpgrade libsmbldap0-32bitUpgrade libsamba-passdb0Upgrade libndr1Upgrade samba-client-32bitUpgrade libsamdb0-32bitUpgrade libsmbldap2Upgrade libndr-nbt-develUpgrade libsamba-credentials0Upgrade libsmbconf-develUpgrade libsamba-util0Upgrade libdcerpc0Upgrade libndr-standard-develUpgrade libndr-krb5pac0-32bitUpgrade libsamba-credentials0-32bitUpgrade libtevent-util-develUpgrade libsamba-hostconfig0Upgrade ctdbUpgrade libdcerpc-binding0-32bitUpgrade libsamba-util-develUpgrade libsamdb-develUpgrade libndr0-32bitUpgrade samba-clientUpgrade libsmbclient-develUpgrade libsamba-errors0-32bitUpgrade libsamba-util0-32bitUpgrade libsamba-policy-python3-develUpgrade libsamba-errors-develUpgrade libsmbclient0-32bitUpgrade libnetapi-develUpgrade libdcerpc-samr-develUpgrade samba-libsUpgrade libsamba-policy0-python3Upgrade libwbclient0Upgrade libnetapi0-32bitUpgrade libsamba-hostconfig-develUpgrade libdcerpc0-32bitUpgrade libsamba-policy-develUpgrade samba-libs-32bitUpgrade libdcerpc-samr0Upgrade libndr-standard0Upgrade libsmbclient0Upgrade libndr-krb5pac-develUpgrade libdcerpc-binding0Upgrade libsamdb0Upgrade libndr-nbt0-32bitUpgrade libsamba-errors0Upgrade libsmbldap-develUpgrade sambaUpgrade libndr0Upgrade libwbclient-develUpgrade libwbclient0-32bitUpgrade libdcerpc-develUpgrade samba-cephUpgrade samba-libs-python3-32bitUpgrade libndr1-32bitUpgrade libndr-standard0-32bitUpgrade libndr-krb5pac0Upgrade libtevent-util0Upgrade libtevent-util0-32bitUpgrade samba-libs-python3Upgrade libsamba-passdb0-32bitUpgrade resource-agentsUpgrade samba-core-develUpgrade libsmbldap0Upgrade samba-python3Upgrade monitoring-plugins-metadataUpgrade libsamba-credentials-develUpgrade libsmbldap2-32bitUpgrade libsmbconf0-32bitUpgrade ldirectordUpgrade libndr-nbt0Upgrade samba-dsdb-modulesUpgrade samba-winbind-32bitUpgrade samba-winbindUpgrade libnetapi0Upgrade samba-docUpgrade libndr-develUpgrade libsamba-policy0Upgrade samba-pythonUpgrade libsmbconf0Upgrade libsamba-hostconfig0-32bit | Aug 17, 2017 | Jul 12, 2017 |
| Ubuntu | — | Upgrade samba-libsUpgrade libkrb5-26-heimdalUpgrade libsmbclient | Jul 15, 2017 | Jul 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub