{"id":151538,"date":"2025-12-14T11:11:58","date_gmt":"2025-12-14T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme"},"modified":"2025-12-14T11:11:58","modified_gmt":"2025-12-14T09:11:58","slug":"uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","title":{"rendered":"Sebess\u00e9gi sebezhet\u0151s\u00e9g a smb4k seg\u00e9dprogramban, amely lehet\u0151v\u00e9 teszi a root jogosults\u00e1gok megszerz\u00e9s\u00e9t a rendszerben","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A smb4k utility used in KDE for detecting and mounting SMB shares has vulnerabilities that allow for root access to the system. The issues have been resolved in the release of Smb4K 4.0.5. You can check the status of the new package version or patch preparation in the distributions on the following pages: Debian, Ubuntu, Fedora, SUSE\/openSUSE, Gentoo, Arch, and FreeBSD. <\/p>\n
To perform privileged actions in smb4k, KAuth handlers are used, which run with root privileges. Vulnerabilities exist in the Smb4KMountHelper handler and are caused by the fact that the functions for mounting (CVE-2025-66003) and unmounting (CVE-2025-66002) the network file system did not properly filter the options passed to the mount.cifs and unmount.cifs commands, allowing an unprivileged user to pass any options to these commands via the mh_options parameter. <\/p>\n
P\u00e9ld\u00e1ul a \"filemode=04777,uid=0\" opci\u00f3k seg\u00edts\u00e9g\u00e9vel minden f\u00e1jl a csatolt part\u00edci\u00f3n suid root jelz\u0151t kap. A felhaszn\u00e1l\u00f3 elind\u00edthat egy SMB szervert, \u00e9s csatlakoztathatja saj\u00e1t part\u00edci\u00f3j\u00e1t a sz\u00fcks\u00e9ges v\u00e9grehajthat\u00f3 f\u00e1jlokkal, amelyek a \"filemode=04777,uid=0\" opci\u00f3k be\u00e1ll\u00edt\u00e1sakor root jogosults\u00e1gokkal fognak v\u00e9grehajt\u00f3dni. <\/p>\n
The Smb4KMountHelper handler also did not properly check the target directories, which, for example, allowed a user to mount their SMB share instead of the \/bin directory and replace it with a modified version of \/bin\/bash. Additionally, through the mh_krb5ticket parameter, one can change the path to the Kerberos credentials file and obtain the contents of any file, for example, \/etc\/shadow, to stderr or a publicly accessible log. <\/p>\n
A Smb4KMountHelper::unmount() f\u00fcggv\u00e9nyben tal\u00e1lhat\u00f3 sebezhet\u0151s\u00e9g a rendszerszakaszok lev\u00e1laszt\u00e1s\u00e1ra haszn\u00e1lhat\u00f3 szolg\u00e1ltat\u00e1smegtagad\u00e1ssal (DoS) \u00fagy, hogy manipul\u00e1lj\u00e1k az mh_mountpoint param\u00e9ter tartalm\u00e1t. \u00c9rdekes m\u00f3don a k\u00f3dban volt egy ellen\u0151rz\u00e9s a part\u00edci\u00f3nak a t\u00edpus\u00e1ra, amely csak a cifs, smbfs \u00e9s smb3 part\u00edci\u00f3kat engedte meg, de az if blokkban a hibakib\u0151v\u00edt\u0151 \u00fczenethez nem ker\u00fclt be az \"return\" utas\u00edt\u00e1s, \u00edgy a v\u00e9grehajt\u00e1s nem szakadt meg. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"