[Pkg-samba-maint] Bug#868209: CVE-2017-11103: MitM attack, impersonation of the Kerberos client, known as Orpheus Lyre

[Raphael Hertzog]

Source: samba
Severity: grave
Tags: security patch
Version: 2:4.1.11+dfsg-1

Hi,

the following vulnerability was published for samba (due to its embedded
copy of heimdal). I checked the build logs for unstable and apparently it
does use this copy (I don't know the status for older releases).

CVE-2017-11103[0]: MitM attack, impersonation of the Kerberos client, know as Orpheus Lyre

A dedicated website is here:
https://orpheus-lyre.info/

The samba announce and patch are here:
https://www.samba.org/samba/security/CVE-2017-11103.html
https://download.samba.org/pub/samba/patches/security/samba-4.x.y-CVE-2017-11103.patch

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11103
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103

Please adjust the affected versions in the BTS as needed.

-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/