QNAP Systems Inc. patched vulnerabilities that could have enabled attackers to take control of its network-attached...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
storage products. What were the QNAP vulnerabilities and how serious were they?
The most serious of the QNAP vulnerabilities were found in version 4.2.4 of QTS, the Linux-based operating system running on QNAP network-attached storage (NAS) devices. All the devices were connected to a network that provided access to a heterogeneous group of clients.
These vulnerabilities -- tracked as CVE-2017-6359 and CVE-2017-6360 -- received the highest Common Vulnerability Scoring System (CVSS) severity score of 10, meaning the vulnerabilities were network-exploitable with low complexity attacks and no authentication required. The attacker could exploit the authentication bypass vulnerability by gaining root access to take control of the affected devices.
With little knowledge, the attacker could automate the exploitation of command injection flaws and attack a QNAP NAS device. The device had to be connected to the internet for the exploitation to happen, and when it did, sensitive information could be disclosed and maliciously modified.
The victims would not be able to access the system resources that they needed to properly manage the devices. The system would completely shut down. All data would be lost if the victim didn't regularly back it up.
Another of the QNAP vulnerabilities was a poorly encrypted domain administrator password. This vulnerability -- tracked as CVE-2017-5227 -- received a medium CVSS severity score of five out of 10.
The attacker could see the password's location in the Linux configuration file. This file could reveal that the NAS device joined as an Active Directory domain. Legitimate Linux clients are authenticated to Active Directory via several Pluggable Authentication Modules that are part of most Linux distributions. This type of authentication is part of the Linux-Window integration.
According to QNAP, the flaws were patched with the release of QNAP QTS 4.2.4 build 20170313. The update patched privilege escalation, command injection, SQL injection, cross-site scripting, clickjacking, credentials management, access bypass and various memory corruption vulnerabilities. Newer versions of QNAP QTS are now available.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Check out the ultimate guide to network-attached storage
Find out how to combat NAS device security risks
Learn how USBee turns USB storage devices into covert channels
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Judith Myerson
Vulnerabilities in Ruggedcom switches could open the industrial switches and other communication devices up to attacks. Expert Judith Myerson ...continue reading
Enterprises should consider pressing 4G vulnerabilities when developing a BYOD strategy for their employees. Expert Judith Myerson explains the flaws...continue reading
A botnet-based local file inclusion attack targeted IBM X-Force customers. Expert Judith Myerson explains how these attacks work and how enterprises ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.