Summary
QNAP heeft kwetsbaarheden verholpen in verschillende versies van hun besturingssystemen, waaronder QTS en QuTS hero.
Details
Interpretaties
De kwetsbaarheden omvatten onjuiste authenticatie, problemen met certificaatvalidatie, onjuiste URL-codering, CRLF-injectie en command injection. Deze kwetsbaarheden stelden aanvallers in staat om ongeautoriseerde toegang te verkrijgen, systeemfunctionaliteit te verstoren, applicatiegegevens te wijzigen en zelfs willekeurige commando's uit te voeren op Network Attached Storage (NAS) apparaten.
Oplossingen
QNAP heeft specifieke latere versies van het besturingssysteem uitgebracht om deze kwetsbaarheden te verhelpen. Organisaties die gebruikmaken van de getroffen QNAP-producten wordt aangeraden om te updaten naar deze versies om hun systemen te beveiligen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 8
-
High 8.7
QTS, QuTS hero
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed th…
-
High 8.7
QTS, QuTS hero
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions…
-
High 7.3
QTS, QuTS hero
An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow attackers with local network access to compromise the security of the system. We have already fixe…
-
Medium 5.3
QTS, QuTS hero
An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the …
-
Medium 5.3
QTS, QuTS hero
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed th…
-
Low 2.3
QTS, QuTS hero
An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state. We have already fixed t…
-
Low 2.1
QTS, QuTS hero
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify me…
-
Low 2.1
QTS, QuTS hero
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify me…
Revision history
-
#0
Initiele versie
References
-
Reference - cveprojectv5; nvd
https://www.qnap.com/en/security-advisory/qsa-24-49