Saint Orpheus' Lyre, Who Sang Unauthenticated Data

Patron of Kerberos, fields nobody checks, and messages believed on their word.

Life

In July 2017 Jeffrey Altman, Viktor Dukhovni and Nicolas Williams revealed Orpheus' Lyre (CVE-2017-11103 and related), a flaw in several Kerberos implementations, Heimdal above all. The client trusted certain metadata taken from the plaintext part of the ticket instead of the encrypted, authenticated part, and with that oversight an attacker could impersonate services. Like Orpheus' lyre, a lovely melody that opened doors meant to stay shut.

Prayer

O Saint Orpheus' Lyre, who charms clients with unsigned data, teach our protocols to believe only what is authenticated. Amen.

How to celebrate

Celebrated by updating the affected Kerberos implementations and trusting only the encrypted part of the ticket.

A lovely melody, a door thrown wide.