QNAP Systems Inc. patched vulnerabilities that could have enabled attackers to take control of its network-attached...
storage products. What were the QNAP vulnerabilities and how serious were they?
The most serious of the QNAP vulnerabilities were found in version 4.2.4 of QTS, the Linux-based operating system running on QNAP network-attached storage (NAS) devices. All the devices were connected to a network that provided access to a heterogeneous group of clients.
These vulnerabilities -- tracked as CVE-2017-6359 and CVE-2017-6360 -- received the highest Common Vulnerability Scoring System (CVSS) severity score of 10, meaning the vulnerabilities were network-exploitable with low complexity attacks and no authentication required. The attacker could exploit the authentication bypass vulnerability by gaining root access to take control of the affected devices.
With little knowledge, the attacker could automate the exploitation of command injection flaws and attack a QNAP NAS device. The device had to be connected to the internet for the exploitation to happen, and when it did, sensitive information could be disclosed and maliciously modified.
The victims would not be able to access the system resources that they needed to properly manage the devices. The system would completely shut down. All data would be lost if the victim didn't regularly back it up.
Another of the QNAP vulnerabilities was a poorly encrypted domain administrator password. This vulnerability -- tracked as CVE-2017-5227 -- received a medium CVSS severity score of five out of 10.
The attacker could see the password's location in the Linux configuration file. This file could reveal that the NAS device joined as an Active Directory domain. Legitimate Linux clients are authenticated to Active Directory via several Pluggable Authentication Modules that are part of most Linux distributions. This type of authentication is part of the Linux-Window integration.
According to QNAP, the flaws were patched with the release of QNAP QTS 4.2.4 build 20170313. The update patched privilege escalation, command injection, SQL injection, cross-site scripting, clickjacking, credentials management, access bypass and various memory corruption vulnerabilities. Newer versions of QNAP QTS are now available.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Check out the ultimate guide to network-attached storage
Find out how to combat NAS device security risks
Learn how USBee turns USB storage devices into covert channels
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Judith Myerson
A swatting attack resulted in the death of a Kansas man. Expert Judith Myerson looks at the technology these attacks use and what can be done to make...continue reading
The Devil's Ivy bug affects millions of internet-connected security cameras. Expert Judith Myerson explains how the exploit works and what can be ...continue reading
An IoT botnet attack on Huawei home routers showed similarities to the Mirai malware. Expert Judith Myerson explains the threat and how enterprises ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.