CVE-2017-11103

What it actually does

The flaw causes _krb5_extract_ticket() to read the service principal name from the unencrypted 'ticket' field instead of the encrypted 'enc_part', violating the Kerberos 5 specification and enabling service impersonation.

Why it matters to the business

Organizations using affected Heimdal versions in Kerberos deployments face risk of unauthorized service access and potential credential or data compromise; the issue is long-public with low observed exploitation and no ransomware association.

How an attack unfolds

An attacker intercepts or influences a KDC-REP, supplies a ticket containing a forged service principal name in the unencrypted portion, and causes the client to accept the ticket for an impersonated service, bypassing normal authentication checks.

How to fix it

Upgrade Heimdal to the fixed commit a3d72c604378e0bff787cc426f2b17f75b112dce (version 7.4 or later). WordPress/WordPress deployments embedding Heimdal should update to commit 76e86a586b0e8ba69ed5e733a296473e21b0f14c.

How to confirm the fix worked

Confirm Heimdal version is 7.4 or newer; inspect source for the corrected _krb5_extract_ticket logic that sources the service name exclusively from enc_part; re-test Kerberos service ticket validation flows.

Typical attack path

1. Position to observe or manipulate Kerberos ticket exchanges between client and KDC
2. Craft or alter a KDC-REP so the unencrypted ticket field contains an attacker-chosen service principal
3. Deliver the malformed ticket to the victim client
4. Client accepts the ticket based on the unencrypted name and establishes a session with the impersonated service

How to detect it

Review Kerberos KDC and application logs for mismatched or unexpected service principal names in tickets; search threat intelligence for references to Orpheus' Lyre attacks targeting Heimdal.

What your security team should do

• Apply the listed Heimdal and WordPress fixes immediately on all affected systems
• Audit Kerberos realms for any custom or embedded Heimdal builds
• Monitor authentication logs for unusual service principal usage or ticket anomalies
• Review downstream dependencies for additional packages shipping vulnerable Heimdal code