{"id":151538,"date":"2025-12-14T11:11:58","date_gmt":"2025-12-14T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme"},"modified":"2025-12-14T11:11:58","modified_gmt":"2025-12-14T09:11:58","slug":"uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-utilite-smb4k-pozvolyayushhaya-poluchit-prava-root-v-sisteme","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb utilitetin smb4k, e cila lejon marrjen e t\u00eb drejtave root n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb utilitarin smb4k, q\u00eb p\u00ebrdoret n\u00eb KDE p\u00ebr identifikimin dhe montimin e partitioneve SMB, jan\u00eb zbuluar dob\u00ebsi q\u00eb lejojn\u00eb aksesin n\u00eb sistem me t\u00eb drejtat e root. Problemet jan\u00eb adresuar n\u00eb lirimin Smb4K 4.0.5. Mund t\u00eb kontrolloni statusin e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitjes s\u00eb nj\u00eb rregullimi n\u00eb shp\u00ebrndarjet e m\u00ebposhtme: Debian, Ubuntu, Fedora, SUSE\/openSUSE, Gentoo, Arch dhe FreeBSD. <\/p>\n
P\u00ebr t\u00eb kryer veprime me privilegje n\u00eb smb4k, p\u00ebrdoren p\u00ebrpunuesit KAuth, t\u00eb cil\u00ebt aktivehen me t\u00eb drejtat e root. Dob\u00ebsit\u00eb jan\u00eb t\u00eb pranishme n\u00eb p\u00ebrpunuesin Smb4KMountHelper dhe shkaktohen nga fakti se funksionet p\u00ebr montimin (CVE-2025-66003) dhe \u00e7montimin (CVE-2025-66002) e sistemit t\u00eb skedave rrjetor nuk filtrojn\u00eb si duhet opsionet q\u00eb i kalohen komandave mount.cifs dhe unmount.cifs, duke lejuar nj\u00eb p\u00ebrdorues t\u00eb pa privilegjuar t\u00eb kaloj\u00eb \u00e7far\u00ebdo opsionesh p\u00ebrmes parametrin mh_options. <\/p>\n
P\u00ebr shembull, duke p\u00ebrdorur opsionet «filemode=04777,uid=0», t\u00eb gjitha skedar\u00ebve n\u00eb pjes\u00ebn e montuar do t'u vihet flamuri suid root. P\u00ebrdoruesi mund t\u00eb niste nj\u00eb server SMB dhe t\u00eb montonte nj\u00eb pjes\u00eb t\u00eb tij t\u00eb vet\u00eb p\u00ebr me skedar\u00ebt ekzekutues t\u00eb nevojsh\u00ebm, t\u00eb cilat me opcione «filemode=04777,uid=0» do t\u00eb ekzekutoheshin me t\u00eb drejtat e root. <\/p>\n
N\u00eb p\u00ebrpunuesin Smb4KMountHelper gjithashtu nuk jan\u00eb verifikuar si duhet katalog\u00ebt target, gj\u00eb q\u00eb, p\u00ebr shembull, lejon montimin e partitionit tuaj SMB n\u00eb vend t\u00eb katalogut \/bin dhe z\u00ebvend\u00ebsimin e tij me nj\u00eb version t\u00eb modifikuar t\u00eb \/bin\/bash. P\u00ebr m\u00eb tep\u00ebr, p\u00ebrmes parametrin mh_krb5ticket \u00ebsht\u00eb e mundur t\u00eb ndryshoni rrug\u00ebn p\u00ebr skedarin me akreditiv\u00ebt Kerberos dhe t\u00eb arrini t\u00eb nxirrni p\u00ebrmbajtjen e ndonj\u00eb skedari, p\u00ebr shembull, \/etc\/shadow, n\u00eb stderr ose log publik. <\/p>\n
Vulnera n\u00eb funksionin Smb4KMountHelper::unmount() mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb shkaktuar nj\u00eb mohimin e sh\u00ebrbimit duke desmontuar pjes\u00ebt sistemike, duke manipuluar p\u00ebrmbajtjen e parametrave mh_mountpoint. P\u00ebr interes, n\u00eb kod kishte nj\u00eb kontroll p\u00ebr llojin e pjes\u00ebs, i cili lejonte vet\u00ebm pjes\u00eb cifs, smbfs dhe smb3, por n\u00eb bllokun if p\u00ebr t\u00eb shp\u00ebrfaqur nj\u00eb gabim, operatori «return» ishte l\u00ebn\u00eb jasht\u00eb dhe ekzekutimi nuk u nd\u00ebrpre. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"