QNAP Systems Inc. patched vulnerabilities that could have enabled attackers to take control of its network-attached...
storage products. What were the QNAP vulnerabilities and how serious were they?
The most serious of the QNAP vulnerabilities were found in version 4.2.4 of QTS, the Linux-based operating system running on QNAP network-attached storage (NAS) devices. All the devices were connected to a network that provided access to a heterogeneous group of clients.
These security vulnerabilities -- tracked as CVE-2017-6359 and CVE-2017-6360 -- received the highest Common Vulnerability Scoring System (CVSS) severity score of 10, meaning the vulnerabilities were network-exploitable with low complexity attacks and no authentication required. The attacker could exploit the authentication bypass vulnerability by gaining root access to take control of the affected devices.
With little knowledge, the attacker could automate the exploitation of command injection flaws and attack QNAP NAS devices. The NAS devices had to be connected to the internet for the exploitation to happen, and when it did, sensitive information could be disclosed and maliciously modified.
The victims would not be able to access the system resources that they needed to properly manage the devices. The system would completely shut down. All data would be lost if the victim didn't regularly back it up.
Another of the QNAP vulnerabilities was a poorly encrypted domain administrator password. This vulnerability -- tracked as CVE-2017-5227 -- received a medium CVSS severity score of five out of 10.
The attacker could see the password's location in the Linux configuration file. This file could reveal that the NAS device joined as an Active Directory domain. Legitimate Linux clients are authenticated to Active Directory via several Pluggable Authentication Modules that are part of most Linux distributions. This type of authentication is part of the Linux-Window integration.
According to QNAP, the flaws were patched with the release of QNAP QTS 4.2.4 build 20170313. The update patched privilege escalation, command injection, SQL injection, cross-site scripting, clickjacking, credentials management, access bypass and various memory corruption vulnerabilities. Newer versions of QNAP QTS are now available.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Check out the ultimate guide to network-attached storage
Find out how to combat NAS device security risks
Why a vendor-based vulnerability assessment scoring system is beneficial
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Judith Myerson
Air-gapped computers subject to PowerHammer attack: Proof-of-concept attack enables data exfiltration through control of current flow over power ... Continue Reading
Bastille researchers created the SirenJack proof of concept to show how a vulnerability could put San Francisco's emergency warning system at risk. ... Continue Reading
A QR code vulnerability was recently discovered in the Apple iOS 11 camera app. Learn how an attacker could exploit it and how to avoid the issue ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.