Description
A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local attackers who have gained user access to gain access to otherwise unauthorized resources.
We have already fixed the vulnerability in the following versions:
QVPN Device Client for Mac 2.2.5 and later
Qsync for Mac 5.1.3 and later
Qfinder Pro Mac 7.11.1 and later
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QNAP Systems | QVPN Device Client for Mac | 2.2.x – < 2.2.5 | 2.2.5 |
| QNAP Systems | Qsync for Mac | 5.1.x – < 5.1.3 | 5.1.3 |
| QNAP Systems | Qfinder Pro Mac | 7.11.x – < 7.11.1 | 7.11.1 |