{"id":100430,"date":"2021-06-04T10:23:35","date_gmt":"2021-06-04T08:23:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-polkit-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme"},"modified":"2021-06-04T10:23:35","modified_gmt":"2021-06-04T08:23:35","slug":"uyazvimost-v-polkit-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-polkit-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","title":{"rendered":"Nj\u00eb cenueshm\u00ebri n\u00eb Polkit, e cila lejon rritjen e privilegjeve n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb komponentin Polkit, i p\u00ebrdorur n\u00eb shp\u00ebrndarjet p\u00ebr organizimin e veprimeve nga p\u00ebrdoruesit pa privilegje q\u00eb k\u00ebrkojn\u00eb t\u00eb drejta t\u00eb rritura (p.sh., montimi i nj\u00eb USB), u zbulua nj\u00eb cenueshm\u00ebri (CVE-2021-3560), e cila lejon nj\u00eb p\u00ebrdorues lokal t\u00eb marr\u00eb t\u00eb drejtat root n\u00eb sistem. Cenueshm\u00ebria \u00ebsht\u00eb eliminuar n\u00eb versionin Polkit 0.119. <\/p>\n

Problemi shfaqet duke filluar nga versioni 0.113, por shum\u00eb shp\u00ebrndarje, p\u00ebrfshir\u00eb RHEL, Ubuntu, Debian dhe SUSE, e kan\u00eb b\u00ebrthamuar funksionalitetin e cenuesh\u00ebm n\u00eb pakot q\u00eb bazohen n\u00eb versione m\u00eb t\u00eb vjetra t\u00eb Polkit (patch-et e pakove tashm\u00eb jan\u00eb n\u00eb dispozicion n\u00eb shp\u00ebrndarje). <\/p>\n

Problemi shfaqet n\u00eb funksionin polkit_system_bus_name_get_creds_sync(), i cili merr identifikuesit (uid dhe pid) t\u00eb procesit q\u00eb k\u00ebrkon rritjen e privilegjeve. Procesi identifikohet nga Polkit p\u00ebrmes caktimit t\u00eb nj\u00eb emri unik n\u00eb DBus, i cili m\u00eb pas p\u00ebrdoret p\u00ebr verifikimin e privilegjeve. N\u00ebse procesi shky\u00e7et nga dbus-daemon menj\u00ebher\u00eb para fillimit t\u00eb trajtuesit polkit_system_bus_name_get_creds_sync, at\u00ebher\u00eb n\u00eb vend t\u00eb emrit unik, trajtuesi merr nj\u00eb kod gabimi. <\/p>\n

Vulnerabiliteti shkaktohet nga m\u00ebnyra se si trajtohet kodi i gabimit t\u00eb kthyer, ku funksioni polkit_system_bus_name_get_creds_sync() kthen vler\u00ebn TRUE n\u00eb vend t\u00eb FALSE, megjith\u00ebse nuk arriti t\u00eb p\u00ebrputh\u00eb procesin me uid\/pid dhe t\u00eb verifikoj\u00eb privilegjet e k\u00ebrkuara p\u00ebr procesin. Kodi nga i cili u thirr funksioni polkit_system_bus_name_get_creds_sync() e konsideron se kontrolli u krye me sukses dhe k\u00ebrkesa p\u00ebr t\u00eb rritur privilegjet erdhi nga root, e jo nga nj\u00eb p\u00ebrdorues i pa privilegjuar, duke ofruar mund\u00ebsin\u00eb p\u00ebr t\u00eb kryer veprime me privilegje pa autentifikim dhe konfirmim t\u00eb m\u00ebtejsh\u00ebm.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Polkit, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f USB-\u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044f), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3560), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Polkit 0.119. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 0.113, \u043d\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL, Ubuntu, Debian \u0438 SUSE, \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100430","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb Polkit, q\u00eb lejon rritjen e privilegjeve n\u00eb sistem | ProHoster","description":"N\u00eb komponentin Polkit, i p\u00ebrdorur n\u00eb shp\u00ebrndarjet p\u00ebr t\u00eb organizuar ekzekutimin e veprimeve nga p\u00ebrdoruesit e pa privilegjuar q\u00eb k\u00ebrkojn\u00eb t\u00eb drejta t\u00eb rritura (p.sh., montimi i ndihm\u00ebs USB), \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-3560) q\u00eb lejon p\u00ebrdoruesin lokal t\u00eb fitoj\u00eb t\u00eb drejtat root n\u00eb sistem. Dob\u00ebsia \u00ebsht\u00eb zgjidhur n\u00eb versionin Polkit 0.119. Problemi shfaqet q\u00eb nga shp\u00ebrndarja 0.113, por shum\u00eb shp\u00ebrndarje, duke p\u00ebrfshir\u00eb RHEL, Ubuntu, Debian dhe SUSE, e kan\u00eb backportuar funksionalitetin e cenuesh\u00ebm n\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-polkit-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Polkit, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Polkit, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f USB-\u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044f), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3560), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Polkit 0.119. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 0.113, \u043d\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f RHEL, Ubuntu, Debian \u0438 SUSE, \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0432","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-polkit-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-04T08:23:35+00:00","article:modified_time":"2021-06-04T08:23:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100430","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-04 08:47:07","updated":"2022-10-01 09:54:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=100430"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100430\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=100430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=100430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=100430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}