Jeffrey Altman

The issue is related to the implementation of the Kerberos protocol in Heimdal, specifically with errors in cryptographic key management. This allows a remote attacker to perform a man-in-the-middle attack due to the failure to verify anonymous PKINIT PA-PKINIT-KX key exchange. The problem is located in the `krb5 init creds step` function in `lib/krb5/init creds pw.c`.

An issue in the backup tape controller process allows unauthenticated RPCs, resulting in operations being performed with administrator credentials. This includes dumping and restoring volume contents and manipulating the backup database. An unauthenticated attacker can replace any volume's content with arbitrary data.

The issue is related to the ` krb5 extract ticket()` function, which obtains service-principal names in a way that violates the Kerberos 5 protocol specification. This allows remote attackers to impersonate services with Orpheus' Lyre attacks. The problem arises because the function uses the unencrypted version of the service name stored in `ticket` instead of the encrypted version stored in `enc part`. This provides an opportunity for successful server impersonation and other attacks.

A security-feature bypass issue allows attackers to affect the system. This issue is related to Kerberos failing to prevent tampering with the SNAME field during ticket exchange.

The issue is related to a heap-based buffer overflow in the cache manager of the client in OpenAFS, which can be exploited by remote attackers. This can be achieved by sending an RX response containing more data than specified in a request, potentially leading to a denial of service or the execution of arbitrary code. The vulnerability is associated with the use of XDR arrays. Multiple vulnerabilities in the OpenAFS package can lead to breaches of confidentiality, integrity, and availability of protected information, and these vulnerabilities can be exploited remotely.