High 8.1Published Jul 13, 2017

CVE-2017-11103Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification.

Updated under an hour ago (Nov 2, 2026, 12:10 AM ET)

Does this affect you?

It affects heimdal_project heimdal and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for heimdal_project heimdal Exploited in the last 30 days

Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specification is violated.

CVSS: 8.1 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-345
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

heimdal_project heimdal heimdal_project:heimdal	before 7.4.0	NVD
freebsd freebsd freebsd:freebsd	all versions	NVD
samba samba samba:samba	from 4.0.0 before 4.4.15; from 4.5.0 before 4.5.12; from 4.6.0 before 4.6.6	NVD
apple iphone_os apple:iphone_os	before 11.0	NVD
apple mac_os_x apple:mac_os_x	before 10.13.1	NVD
debian debian_linux debian:debian_linux	8.0; 9.0; 10.0	NVD

References

References

http://www.debian.org/security/2017/dsa-3912	third-party-advisory
http://www.h5l.org/advisories.html?show=2017-07-11	broken-link
http://www.securityfocus.com/bid/99551	third-party-advisory, vdb-entry
http://www.securitytracker.com/id/1038876	third-party-advisory, vdb-entry
http://www.securitytracker.com/id/1039427	third-party-advisory, vdb-entry
https://github.com/heimdal/heimdal/releases/tag/heimdal-7.4.0	release-notes
https://support.apple.com/HT208112	third-party-advisory
https://support.apple.com/HT208144	third-party-advisory
https://support.apple.com/HT208221	third-party-advisory
https://www.freebsd.org/security/advisories/FreeBSD-SA-17:05.heimdal.asc	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.