Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - Heimdal before 7.4 allows remote attackers to     impersonate services with Orpheus' Lyre attacks because     it obtains service-principal names in a way that     violates the Kerberos 5 protocol specification. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from the encrypted version stored in     'enc_part' instead of the unencrypted version stored in     'ticket'. Use of the unencrypted version provides an     opportunity for successful server impersonation and     other attacks. NOTE: this CVE is only for Heimdal and     other products that embed Heimdal code it does not     apply to other instances in which this part of the     Kerberos 5 protocol specification is     violated.(CVE-2017-11103)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heimdal before 7.4 allows remote attackers to     impersonate services with Orpheus' Lyre attacks because     it obtains service-principal names in a way that     violates the Kerberos 5 protocol specification. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from the encrypted version stored in     'enc_part' instead of the unencrypted version stored in     'ticket'. Use of the unencrypted version provides an     opportunity for successful server impersonation and     other attacks. NOTE: this CVE is only for Heimdal and     other products that embed Heimdal code it does not     apply to other instances in which this part of the     Kerberos 5 protocol specification is     violated.(CVE-2017-11103)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - There is an issue in all samba 4.11.x versions before     4.11.5, all samba 4.10.x versions before 4.10.12 and     all samba 4.9.x versions before 4.9.18, where the     removal of the right to create or modify a subtree     would not automatically be taken away on all domain     controllers.(CVE-2019-14902)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before     4.10.12 and 4.11.x before 4.11.5 have an issue where if     it is set with 'log level = 3' (or above) then the     string obtained from the client, after a failed     character conversion, is printed. Such strings can be     provided during the NTLMSSP authentication exchange. In     the Samba AD DC in particular, this may cause a     long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely     target, smbd, operates as process-per-client and so a     crash there is harmless).(CVE-2019-14907)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - A flaw was found in the samba client, all samba     versions before samba 4.11.2, 4.10.10 and 4.9.15, where     a malicious server can supply a pathname to the client     with separators. This could allow the client to access     files and folders outside of the SMB network pathnames.
    An attacker could use this vulnerability to create     files outside of the current working directory using     the privileges of the client user.(CVE-2019-10218)

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iOS running on the mobile device is prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities as described in the HT208143 security advisory.

The remote host is running a version of macOS that is prior to 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Apache
 - AppSandbox
 - AppleScript
 - Application Firewall
 - ATS
 - Audio
 - CFNetwork
 - CFNetwork Proxies
 - CFString
 - Captive Network Assistant
 - CoreAudio
 - CoreText
 - DesktopServices
 - Directory Utility
 - file
 - Fonts
 - fsck_msdos
 - HFS
 - Heimdal
 - HelpViewer
 - IOFireWireFamily
 - ImageIO
 - Installer
 - Kernel
 - kext tools
 - libarchive
 - libc
 - libexpat
 - Mail
 - Mail Drafts
 - ntp
 - Open Scripting Architecture
 - PCRE
 - Postfix
 - Quick Look
 - QuickTime
 - Remote Management
 - SQLite
 - Sandbox
 - Screen Lock
 - Security
 - Spotlight
 - WebKit
 - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of Apple iOS running on the mobile device is prior to 11. It is, therefore, affected by multiple vulnerabilities as described in the HT208112 security advisory.

This update provides Samba 4.6.7, which fixes the following issues :

  - CVE-2017-11103: Metadata were being taken from the     unauthenticated plaintext (the Ticket) rather than the     authenticated and encrypted KDC response. (bsc#1048278)

  - Fix cephwrap_chdir(). (bsc#1048790)

  - Fix ctdb logs to /var/log/log.ctdb instead of     /var/log/ctdb. (bsc#1048339)

  - Fix inconsistent ctdb socket path. (bsc#1048352)

  - Fix non-admin cephx authentication. (bsc#1048387)

  - CTDB cannot start when there is no persistent database.
    (bsc#1052577)

The CTDB resource agent was also fixed to not fail when the database is empty.

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update provides Samba 4.6.7, which fixes the following issues :

  - CVE-2017-11103: Metadata were being taken from the     unauthenticated plaintext (the Ticket) rather than the     authenticated and encrypted KDC response. (bsc#1048278)

  - Fix cephwrap_chdir(). (bsc#1048790)

  - Fix ctdb logs to /var/log/log.ctdb instead of     /var/log/ctdb. (bsc#1048339)

  - Fix inconsistent ctdb socket path. (bsc#1048352)

  - Fix non-admin cephx authentication. (bsc#1048387)

  - CTDB cannot start when there is no persistent database.
    (bsc#1052577) The CTDB resource agent was also fixed to     not fail when the database is empty.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libheimdal fixes the following issues :

  - Fix CVE-2017-11103: Orpheus' Lyre KDC-REP service name     validation. This is a critical vulnerability. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from encrypted version stored in 'enc_part'     instead of the unencrypted version stored in 'ticket'.
    Use of the unecrypted version provides an opportunity     for successful server impersonation and other attacks.
    Identified by Jeffrey Altman, Viktor Duchovni and Nico     Williams. See https://www.orpheus-lyre.info/ for more     details. (bsc#1048278)

  - Fix CVE-2017-6594: transit path validation inadvertently     caused the previous hop realm to not be added to the     transit path of issued tickets. This may, in some cases,     enable bypass of capath policy in Heimdal versions 1.5     through 7.2. Note, this may break sites that rely on the     bug. With the bug some incomplete [capaths] worked, that     should not have. These may now break authentication in     some cross-realm configurations.

Update to 7.4.0 GA release (CVE-2017-11103)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.4.x prior to 4.4.15, 4.5.x prior to 4.5.12, or 4.6.x prior to 4.6.6. It is, therefore, affected by a logic flaw in the Heimdal implementation of Kerberos, specifically within the _krb5_extract_ticket() function within lib/krb5/ticket.c, due to the unsafe use of cleartext metadata from an unauthenticated ticket instead of the encrypted version stored in the Key Distribution Center (KDC) response. A man-in-the-middle attacker can exploit this issue to impersonate Kerberos services. This can potentially result in a privilege escalation or the theft of credentials. Note that Samba versions built against MIT Kerberos are not impacted by this issue.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3353-2 advisory.

    USN-3353-1 fixed a vulnerability in Heimdal. This update provides the corresponding update for Samba.

    Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered that Samba clients incorrectly trusted     unauthenticated portions of Kerberos tickets. A remote attacker could use this to impersonate trusted     network servers or perform other attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3353-1 advisory.

    Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams discovered that Heimdal clients incorrectly trusted     unauthenticated portions of Kerberos tickets. A remote attacker could use this to impersonate trusted     network services or perform other attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams reported that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, trusts metadata taken from the unauthenticated plaintext (Ticket), rather than the authenticated and encrypted KDC response. A man-in-the-middle attacker can use this flaw to impersonate services to the client.

See https://orpheus-lyre.info/ for details.

Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in samba, the SMB/CIFS file, print, and login server. Also known as Orpheus' Lyre, this vulnerability is located in Samba Kerberos Key Distribution Center (KDC-REP) component and could be used by an attacker on the network path to impersonate a server.

More details can be found on the vulnerability website ( https://orpheus-lyre.info/) and on the Samba project website ( https://www.samba.org/samba/security/CVE-2017-11103.html)

Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in Heimdal Kerberos. Also known as Orpheus' Lyre, this vulnerability could be used by an attacker to mount a service impersonation attack on the client if he's on the network path between the client and the service.

More details can be found on the vulnerability website (https://orpheus-lyre.info/).

For Debian 7 'Wheezy', these problems have been fixed in version 1.6~git20120403+dfsg1-2+deb7u1.

We recommend that you upgrade your heimdal packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

The samba project reports :

A MITM attacker may impersonate a trusted server and thus gain elevated access to the domain by returning malicious replication or authorization data.

ID	Name	Product	Family	Severity
146748	EulerOS 2.0 SP2 : samba (EulerOS-SA-2021-1357)	Nessus	Huawei Local Security Checks	high
140877	EulerOS 2.0 SP3 : samba (EulerOS-SA-2020-2110)	Nessus	Huawei Local Security Checks	high
700542	Apple iOS < 11.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
700511	macOS < 10.13 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	critical
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
103420	Apple iOS < 11 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
102849	openSUSE Security Update : samba and resource-agents (openSUSE-2017-987) (Orpheus' Lyre)	Nessus	SuSE Local Security Checks	high
102696	SUSE SLED12 / SLES12 Security Update : samba / resource-agents (SUSE-SU-2017:2237-1) (Orpheus' Lyre)	Nessus	SuSE Local Security Checks	high
102556	openSUSE Security Update : libheimdal (openSUSE-2017-937) (Orpheus' Lyre)	Nessus	SuSE Local Security Checks	high
101917	Fedora 25 : heimdal (2017-5d6a9e0c9c) (Orpheus' Lyre)	Nessus	Fedora Local Security Checks	high
101915	Fedora 26 : heimdal (2017-2afe501b36) (Orpheus' Lyre)	Nessus	Fedora Local Security Checks	high
101773	Samba 4.4.x < 4.4.15 / 4.5.x < 4.5.12 / 4.6.x < 4.6.6 KDC-REP Service Name Validation (Orpheus' Lyre)	Nessus	Misc.	high
101770	Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3353-2)	Nessus	Ubuntu Local Security Checks	high
101769	Ubuntu 14.04 LTS / 16.04 LTS : Heimdal vulnerability (USN-3353-1)	Nessus	Ubuntu Local Security Checks	high
101557	Debian DSA-3912-1 : heimdal - security update (Orpheus' Lyre)	Nessus	Debian Local Security Checks	high
101554	Debian DSA-3909-1 : samba - security update (Orpheus' Lyre)	Nessus	Debian Local Security Checks	high
101553	Debian DLA-1027-1 : heimdal security update (Orpheus' Lyre)	Nessus	Debian Local Security Checks	high
101550	Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2017-195-02) (Orpheus' Lyre)	Nessus	Slackware Local Security Checks	high
101541	FreeBSD : samba -- Orpheus Lyre mutual authentication validation bypass (85851e4f-67d9-11e7-bc37-00505689d4ae) (Orpheus' Lyre)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-11103

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high