Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade sambaUpgrade heimdal | Sep 20, 2017 | Jul 13, 2017 |
| Apple Osx Heimdal | — | Upgrade macOS to the latest versionApply OS X security update 2017-004 El CapitanApply OS X security update 2017-001 Sierra | Sep 26, 2017 | Jul 13, 2017 |
| Debian | — | Upgrade sambaUpgrade heimdal | Jul 15, 2017 | Jul 12, 2017 |
| Freebsd | — | Upgrade samba44Upgrade samba43Upgrade samba45Upgrade samba42Upgrade samba46 | Jul 13, 2017 | Jul 12, 2017 |
| Hpux | — | Update CIFS-Server to the latest version | Mar 28, 2022 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade samba-common-libsUpgrade libsmbclientUpgrade samba-winbind-modulesUpgrade samba-pythonUpgrade sambaUpgrade libwbclientUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-libsUpgrade samba-commonUpgrade samba-client-libsUpgrade samba-clientUpgrade samba-common-tools | Feb 22, 2021 | Jul 13, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade samba-common-libsUpgrade samba-pythonUpgrade samba-winbind-modulesUpgrade samba-commonUpgrade sambaUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade samba-clientUpgrade samba-winbindUpgrade samba-libsUpgrade libwbclientUpgrade samba-client-libs | Sep 28, 2020 | Jul 13, 2017 |
| Samba | — | Upgrade to Samba version 4.4.15Upgrade to Samba version 4.5.12Upgrade to Samba version 4.6.6 | Jul 17, 2017 | Jul 13, 2017 |
| Suse | — | Upgrade samba-libs-32bitUpgrade libsamba-errors0-32bitUpgrade libsamba-util-develUpgrade libwbclient0Upgrade libsamba-credentials0Upgrade libsamba-hostconfig0Upgrade libsamba-passdb0Upgrade libdcerpc-samr-develUpgrade libsamba-policy-develUpgrade samba-libsUpgrade libndr-krb5pac0-32bitUpgrade libndr0-32bitUpgrade libdcerpc0-32bitUpgrade libdcerpc0Upgrade libsamba-util0-32bitUpgrade libsamba-passdb-develUpgrade libndr-standard0Upgrade libtevent-util-develUpgrade libsmbclient0Upgrade libsamba-errors-develUpgrade libndr1Upgrade libsamba-policy-python3-develUpgrade libsamba-util0Upgrade libsmbclient0-32bitUpgrade ctdbUpgrade libndr-nbt-develUpgrade libsamba-policy0-python3Upgrade libsmbldap0-32bitUpgrade libsmbclient-develUpgrade libsamdb-develUpgrade libdcerpc-binding0-32bitUpgrade libdcerpc-samr0Upgrade samba-client-32bitUpgrade samba-clientUpgrade libsmbldap2Upgrade libsamdb0-32bitUpgrade libsamba-hostconfig-develUpgrade libnetapi0-32bitUpgrade libnetapi-develUpgrade samba-kdcUpgrade libndr-standard-develUpgrade libsmbconf-develUpgrade libsamba-credentials0-32bitUpgrade libsamba-policy0Upgrade libnetapi0Upgrade libdcerpc-binding0Upgrade libndr-nbt0Upgrade libtevent-util0Upgrade libndr-krb5pac0Upgrade libwbclient0-32bitUpgrade samba-dsdb-modulesUpgrade libsamba-passdb0-32bitUpgrade libndr-standard0-32bitUpgrade libwbclient-develUpgrade libndr0Upgrade samba-python3Upgrade samba-core-develUpgrade sambaUpgrade libtevent-util0-32bitUpgrade samba-cephUpgrade libdcerpc-develUpgrade samba-libs-python3Upgrade samba-winbind-32bitUpgrade ldirectordUpgrade libsmbldap0Upgrade libndr1-32bitUpgrade libsamdb0Upgrade monitoring-plugins-metadataUpgrade samba-winbindUpgrade resource-agentsUpgrade libsamba-credentials-develUpgrade libsmbconf0Upgrade libndr-krb5pac-develUpgrade samba-pythonUpgrade libsamba-hostconfig0-32bitUpgrade libndr-nbt0-32bitUpgrade libsmbconf0-32bitUpgrade samba-libs-python3-32bitUpgrade libndr-develUpgrade samba-docUpgrade libsmbldap-develUpgrade libsmbldap2-32bitUpgrade libsamba-errors0 | Aug 17, 2017 | Jul 12, 2017 |
| Ubuntu | — | Upgrade libsmbclientUpgrade samba-libsUpgrade libkrb5-26-heimdal | Jul 15, 2017 | Jul 12, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub