Byagenze bite
Abakinnyi bakangisha gukoresha intege nke (CVE - 2026‑61500, CVSS 9.3) kumugaragaro - isoko Rejetto HTTP File Server (HFS). Inenge yemerera abakoresha batemewe kongera kubaka isomo key urufunguzo rwo gusinya kuki mu kureba ibisubizo bya seriveri ya Math.random (), ikoresha xorshift128 + . Hamwe nurufunguzo rwagaruwe, abateye barashobora guhimba kuki yabayobozi hanyuma bagakora code uko bishakiye bakoresheje iboneza rya seriveri. Horizon3.ai yatangaje ko abashakashatsi bayo bavumbuye inenge bakoresheje moderi ya Mythos AI ya Anthropic, yerekanaga ihinduka rya PRNG. Rejetto yasohoye verisiyo 3.2.1 ku ya 13 Nyakanga hamwe nudupapuro. Ku ya 2 Ukwakira, VulnCheck yihanangirije ko kugerageza gukoreshwa byatangiye, bituruka kuri IP Telecom yo mu Bushinwa ndetse no kwibasira kanseri mu Buyapani no muri Amerika.
Intege nke zikomoka kuri Rejetto HFS yerekana ibisubizo byikiganiro cyayo kitari - kriptografiya generator itanga kuki kubakiriya batabifitiye uburenganzira mugihe cyo kwinjira. Imashini itanga amashanyarazi, ishingiye kuri xorshift128 + , itanga indangagaciro zishobora guhindurwa, bigatuma uwagabye igitero akusanya ibisubizo bike byinjira kugirango yongere yubake imiterere yimbere.
Raporo ya tekiniki ya Horizon3.ai isobanura ko iyo isomo - urufunguzo rwo gusinya kuki rumaze kugarurwa, uwagabye igitero ashobora guhimba kuki zemewe. Izi kuki zahimbwe zitanga uburenganzira buhanitse, butuma kode ya kure ikorwa binyuze mumahitamo ya seriveri_code.
Moderi ya Mythos AI ya Anthropic yakoreshejwe na Horizon3.ai kugirango imenye ihinduka rya PRNG no gutegura inzira yibitero. Imibare ya AI yihutishije kuvumbura inenge, yabwiwe Rejetto muri Kamena.
Rejetto yashubije irekurwa (v3.2.1) ku ya 13 Nyakanga. Icyakora, inama ya VulnCheck yo ku ya 2 Ukwakira yerekana ko kugerageza gukoresha imitwaro byatangiye, byibasira sisitemu ya kanari mu Buyapani no muri Amerika uhereye kuri IP IP yo mu Bushinwa.
Raporo ntabwo itanga igenzura ryigenga ry’ubwumvikane buke burenze ibikorwa by’ubutasi byagaragaye, kandi nta tegeko ry’imikoreshereze rusange ryashyizwe ahagaragara.
Ibisobanuro birambuye: securityweek.com ↗
Impamvu ari ngombwa
Ibyabaye byerekana uburyo AI - yafashije kuvumbura intege nke zishobora kwihutisha ibikorwa byumutekano ndetse n’ibitero. Mugukoresha imibare igezweho yo gutekereza, Mythos yerekanye intege nke zoroshye muri dosiye yoherejwe - ibicuruzwa bya seriveri, bituma ibintu byihuta. Nyamara, ubushishozi bumwe bwa AI - bwakomotse ku busa busa n’intwaro n’abateye mu byumweru, bikerekana seriveri itarashyira mu bikorwa ivugurura. Urebye amanota menshi ya CVSS hamwe nuburyo bworoshye bwo guhimba kuki ya admin, ibyashizweho na HFS bidahuye nabyo bishobora guhura ningaruka zikomeye zo gukora code ya kure, birashobora gutuma habaho ubujura bwamakuru, kohereza incungu, cyangwa urujya n'uruza mu miyoboro. Uru rubanza kandi rushimangira imbogamizi nini yo kubona software ishingiye ku mbaraga zidasanzwe zitanga umubare, cyane cyane iyo izo ntege nke zigaragara cyane binyuze mu isesengura rya AI.
AI - iterwa no kuvumbura intege nke irashobora kugabanya igihe hagati yo kumenya inenge no gusohora patch, kuzamura umutekano muri software. Ibinyuranye, ubushishozi bumwe bwa AI burashobora kwakirwa byihuse nabakinnyi babi, bakanda idirishya kubarwanashyaka.
Gukoresha PRNG ihindagurika kumasomo - gusinya kuki bitubahiriza uburyo bwiza bwo gutondeka ibintu, kwerekana icyiciro cyintege nke zishobora kubaho mumurage cyangwa gufungura imishinga.
Bitewe nuburemere bukabije (CVSS 9.3) hamwe nuburyo bworoshye bwo guhimba ibyangombwa bya admin, uburyo ubwo aribwo bwose bwoherejwe bwa HFS burashobora guhita bugerwaho nogukora kode ya kure, ishobora gukoreshwa muburyo bwo gusohora amakuru, incungu, cyangwa nkibirenge byinjira mumurongo wimbitse.
Ibyabaye birashobora gutuma habaho igenzura ryagutse ryimikorere yimibare idasanzwe muri seriveri y'urubuga hamwe nizindi porogaramu zikoreshwa, bishobora kuganisha ku mabwiriza mashya y’umutekano cyangwa kuvugurura itegeko.
Uburyo bukoreshwa: Uburyo bukora
Shakisha ikoranabuhanga ryihishe inyuma yiri terambere.
A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
Ibyo kureba
Amatsinda yumutekano agomba gukurikirana ibipimo byubwumvikane bujyanye na kuki ya admin ya HFS yahimbwe, nkibikorwa bitunguranye byatewe na seriveri_code cyangwa traffic idasanzwe ituruka kumurongo uzwi wa IP mbi. Amashyirahamwe akoresha Rejetto HFS agomba kugenzura ko verisiyo 3.2.1 cyangwa nyuma yayo yoherejwe kandi agatekereza igice cyinyongera kugirango agabanye imurikagurisha. Abashakashatsi birashoboka ko bazasuzuma niba izindi software zikoresha Math.random () cyangwa PRNG zisa nazo zishobora kwibasirwa n'ibitero bisa byo kwiyubaka, bikaba bishoboka ko bitanga inama nini. Hanyuma, umuryango w’umutekano uzareba uburyo ibikoresho bya AI bikoreshwa mu bushakashatsi bw’abatishoboye no kubikoresha, bigira ingaruka ku gihe kizaza - uburyo bwo kwirinda no kwirinda.
Kumenya kuki zihimbano za admin za HFS mumurongo wurubuga cyangwa sisitemu yo kwemeza.
Irangizwa ridasanzwe ryimyandikire cyangwa amategeko ukoresheje seriveri_code iboneza kuri HFS.
Kugaragara kwa PRNG similar intege nke zijyanye nizindi software, cyane cyane abakoresha Math.random () cyangwa xorshift algorithms.
Ibindi byatangajwe n’ibigo bishinzwe umutekano kubyerekeye AI - byafashaga tekinike yo kuvumbura ningaruka zabyo ahantu nyaburanga.
Ibisubizo byatanzwe na Rejetto kubyerekeranye na mituweli yinyongera, nko gutesha agaciro PRNG itishoboye cyangwa gutanga ibikoresho byo kwimuka kubisanzweho.