CVE-2017-11103

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-13 · updated 2026-06-17
Weakness: CWE-345

Description

Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.

Affected products

Apple Iphone Os: before 11.0 — fixed in 11.0
macOS: before 10.13.1 — fixed in 10.13.1
Debian Linux: 8.0, 9.0, 10.0
FreeBSD: all versions
Heimdal Software Kerberos: before 7.4.0 — fixed in 7.4.0
Samba: from 4.0.0 before 4.4.15; from 4.5.0 before 4.5.12; from 4.6.0 before 4.6.6 — fixed in 4.4.15, 4.5.12, 4.6.6

How to fix

Upgrade to a fixed version: Apple Iphone Os 11.0; macOS 10.13.1; Heimdal Software Kerberos 7.4.0; Samba 4.4.15, 4.5.12, 4.6.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-11103 or the next vulnerability affects your stack