N\u00eb mjetin smb4k, q\u00eb p\u00ebrdoret n\u00eb KDE p\u00ebr zbulimin dhe montimin e ndarjeve SMB, jan\u00eb zbuluar dob\u00ebsi q\u00eb mund\u00ebsojn\u00eb marrjen e aksesit root n\u00eb sistem. Problemet jan\u00eb korrigjuar n\u00eb versionin Smb4K 4.0.5. Statusin e versionit t\u00eb ri t\u00eb paket\u00ebs ose p\u00ebrgatitjen e rregullimit n\u00eb shp\u00ebrndarje mund ta kontrolloni n\u00eb faqet vijuese: Debian, Ubuntu, Fedora, SUSE\/openSUSE, Gentoo, Arch dhe FreeBSD. <\/p>\n
P\u00ebr kryerjen e veprimeve t\u00eb privilegjuara n\u00eb smb4k p\u00ebrdoren p\u00ebrpunues KAuth, t\u00eb cil\u00ebt nisen me t\u00eb drejta root. Dob\u00ebsit\u00eb jan\u00eb t\u00eb pranishme n\u00eb p\u00ebrpunuesin Smb4KMountHelper dhe shkaktohen nga fakti q\u00eb funksionet p\u00ebr montimin (CVE-2025-66003) dhe \u00e7montimin (CVE-2025-66002) e sistemit t\u00eb skedar\u00ebve n\u00eb rrjet nuk filtronin si\u00e7 duhet opsionet e kaluara te komandat mount.cifs dhe unmount.cifs, gj\u00eb q\u00eb i lejonte nj\u00eb p\u00ebrdoruesi pa privilegje t\u2019u kalonte k\u00ebtyre komandave \u00e7far\u00ebdo opsioni p\u00ebrmes parametrit mh_options. <\/p>\n
P\u00ebr shembull, duke p\u00ebrdorur opsionet «filemode=04777,uid=0», t\u00eb gjitha skedar\u00ebt n\u00eb ndarjen e montuar do t\u00eb ken\u00eb flamurin suid root. P\u00ebrdoruesi mund t\u00eb niste nj\u00eb server SMB dhe t\u00eb montonte nj\u00eb ndarje t\u00eb tij me skedar\u00ebt e nevojsh\u00ebm ekzekutiv\u00eb, t\u00eb cil\u00ebt me opsionet «filemode=04777,uid=0» do t\u00eb kryhen me privilegje root. <\/p>\n
N\u00eb p\u00ebrpunuesin Smb4KMountHelper gjithashtu nuk verifikoheshin si\u00e7 duhet drejtorit\u00eb e synuara, gj\u00eb q\u00eb, p\u00ebr shembull, lejonte montimin e ndarjes s\u00eb vet SMB n\u00eb vend t\u00eb drejtoris\u00eb \/bin dhe z\u00ebvend\u00ebsimin aty t\u00eb nj\u00eb versioni t\u00eb modifikuar t\u00eb \/bin\/bash. P\u00ebrve\u00e7 k\u00ebsaj, p\u00ebrmes parametrit mh_krb5ticket mund t\u00eb ndryshohet rruga drejt skedarit me kredencialet Kerberos dhe t\u00eb arrihet nxjerrja e p\u00ebrmbajtjes s\u00eb \u00e7do skedari, p\u00ebr shembull \/etc\/shadow, n\u00eb stderr ose n\u00eb nj\u00eb log publikisht t\u00eb qassh\u00ebm. <\/p>\n
Vulnerabiliteti n\u00eb funksionin Smb4KMountHelper::unmount() mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb shkaktuar nj\u00eb mohimi t\u00eb sh\u00ebrbimit duke shk\u00ebputur ndarjet sistemike, duke manipuluar p\u00ebrmbajtjen e parametrave mh_mountpoint. \u00cbsht\u00eb interesante se n\u00eb kodin ishte nj\u00eb kontroll p\u00ebr llojin e ndarjes, q\u00eb kalonte vet\u00ebm ndarjet cifs, smbfs dhe smb3, por n\u00eb bllokun if p\u00ebr nxjerrjen e gabimeve ishte l\u00ebn\u00eb jasht\u00eb operatori «return» dhe ekzekutimi nuk u nd\u00ebrpre. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"