QNAP recently patched roughly 20 vulnerabilities in its network-attached storage (NAS) products, including weaknesses that can be exploited to take control of affected devices.
According to an advisory published by the vendor last month, the flaws were patched with the release of version 4.2.4 build 20170313 of QTS, the operating system running on QNAP NAS devices.
The update patches privilege escalation, command injection, SQL injection, cross-site scripting (XSS), clickjacking, credentials management, access bypass and various memory corruption vulnerabilities.
Three of the command injection flaws were reported to QNAP by Harry Sintonen of F-Secure, who on Thursday published an advisory detailing his findings. The expert said he informed the vendor of the vulnerabilities in late February.
The security holes discovered by Sintonen, tracked as CVE-2017-6361, CVE-2017-6360 and CVE-2017-6359, can be exploited by authenticated or unauthenticated attackers to execute arbitrary commands on vulnerable devices. Exploitation of the unauthenticated command injection flaws can be automated in attacks aimed at devices that are connected to the Internet.
According to Sintonen, the flaws allow an attacker to gain root access to a device and read or modify all the data stored on it.
Researchers Pasquale Fiorillo and Guido Oricchio also published an advisory detailing a privilege escalation vulnerability (CVE-2017-5227) that was patched with the release of QTS 4.2.4.
The experts discovered that a local user can access a configuration file that contains a poorly encrypted Windows domain administrator password. The password is stored in the configuration file if the NAS device has joined an Active Directory domain, researchers said.
A couple of researchers from Salesforce have also been credited for finding security holes patched in QTS 4.2.4. The flaws found by Fiorillo, Oricchio and Sintonen are the only ones that have been assigned CVE identifiers.
It’s important that users install the update as soon as possible since malware that specifically targets QNAP devices is not unheard of. A few years ago, researchers warned that a worm had been exploiting the ShellShock vulnerability to plant backdoors on NAS devices from QNAP.
Related: Multiple Zero-days Disclosed in Western Digital NAS Storage Devices
Related: NAS Devices Used to Spread Cryptocurrency Mining Malware
Related: LG NAS Devices Exposed to Remote Attacks
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
Latest News
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Google Temporarily Offering $180,000 for Full Chain Chrome Exploit
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
