Jeffrey Altman

**Name of the Vulnerable Software and Affected Versions** Heimdal versions prior to 7.6.0 **Description** The issue is related to the implementation of the Kerberos protocol in Heimdal, specifically with errors in cryptographic key management. This allows a remote attacker to perform a man-in-the-middle attack due to the failure to verify anonymous PKINIT PA-PKINIT-KX key exchange. The problem is located in the `krb5 init creds step` function in `lib/krb5/init creds pw.c`. **Recommendations** For Heimdal versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `krb5 init creds step` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** OpenAFS versions prior to 1.6.23 OpenAFS versions 1.8.x prior to 1.8.2 **Description** An issue in the backup tape controller process allows unauthenticated RPCs, resulting in operations being performed with administrator credentials. This includes dumping and restoring volume contents and manipulating the backup database. An unauthenticated attacker can replace any volume's content with arbitrary data. **Recommendations** For OpenAFS versions prior to 1.6.23, update to version 1.6.23 or later. For OpenAFS versions 1.8.x prior to 1.8.2, update to version 1.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Heimdal versions prior to 7.4 **Description** The issue is related to the ` krb5 extract ticket()` function, which obtains service-principal names in a way that violates the Kerberos 5 protocol specification. This allows remote attackers to impersonate services with Orpheus' Lyre attacks. The problem arises because the function uses the unencrypted version of the service name stored in `ticket` instead of the encrypted version stored in `enc part`. This provides an opportunity for successful server impersonation and other attacks. **Recommendations** For Heimdal versions prior to 7.4, update to version 7.4 or later to resolve the issue. As a temporary workaround, consider modifying the ` krb5 extract ticket()` function to obtain the KDC-REP service name from the encrypted version stored in `enc part` instead of the unencrypted version stored in `ticket`. Restrict access to sensitive data and services until the update is applied to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version **Description** A security-feature bypass issue allows attackers to affect the system. This issue is related to Kerberos failing to prevent tampering with the SNAME field during ticket exchange. **Recommendations** For Microsoft Windows versions prior to the fixed version, update to a version that includes the fix for this issue to prevent attackers from bypassing Extended Protection for Authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenAFS versions 1.0 through 1.4.8 OpenAFS versions 1.5.0 through 1.5.58 **Description** The issue is related to a heap-based buffer overflow in the cache manager of the client in OpenAFS, which can be exploited by remote attackers. This can be achieved by sending an RX response containing more data than specified in a request, potentially leading to a denial of service or the execution of arbitrary code. The vulnerability is associated with the use of XDR arrays. Multiple vulnerabilities in the OpenAFS package can lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely. **Recommendations** For OpenAFS versions 1.0 through 1.4.8, update to version 1.4.9 or later. For OpenAFS versions 1.5.0 through 1.5.58, update to version 1.5.59 or later. As a temporary workaround, consider restricting access to the cache manager to minimize the risk of exploitation.