Nicolas Williams

The issue is related to the ` krb5 extract ticket()` function, which obtains service-principal names in a way that violates the Kerberos 5 protocol specification. This allows remote attackers to impersonate services with Orpheus' Lyre attacks. The problem arises because the function uses the unencrypted version of the service name stored in `ticket` instead of the encrypted version stored in `enc part`. This provides an opportunity for successful server impersonation and other attacks.

A security-feature bypass issue allows attackers to affect the system. This issue is related to Kerberos failing to prevent tampering with the SNAME field during ticket exchange.

The issue allows remote attackers to cause a denial of service, resulting in an incorrect pointer read and process crash. This is achieved by sending a crafted SPNEGO packet that is mishandled during a gss inquire context call.

The issue allows remote attackers to cause a denial of service, resulting in an incorrect pointer read and process crash. This occurs when a crafted IAKERB packet is mishandled during a gss inquire context call, due to reliance on an inappropriate context handle.