QNAP Releases Security Update

QNAP releases security advisories addressing multiple vulnerabilities including a High severity vulnerability in Sudo affecting QTS, QuTS hero, QuTScloud, and QVP (QVR Pro Appliances)

Threat ID:: CC-4292
Threat Severity:: Information only
Published:: 30 March 2023 4:44 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

QNAP releases security advisories addressing multiple vulnerabilities including a High severity vulnerability in Sudo affecting QTS, QuTS hero, QuTScloud, and QVP (QVR Pro Appliances)

Affected platforms

The following platforms are known to be affected:

QNAP QTS

QNAP QuTS Hero

QNAP QuTScloud

QNAP QVR Pro Appliances

Threat details

Introduction

QNAP has released multiple security advisories addressing one High, eight Mediums, and two Low severity vulnerabilities. An unauthenticated remote attacker could exploit some of these vulnerabilities to execute arbitrary code on an affected system.

QNAP addresses Sudo vulnerability

The vulnerability referred to as CVE-2023-22809 relates to a flaw in Sudo’s -e option known as sudoedit. QNAP has reported that this vulnerability affects their QTS, QuTS hero, QuTScloud, and QVP products. CVE-2023-22809 was previously addressed in the NHS Cyber Alert CC-4247.

Remediation advice

Affected organisations are encouraged to review the QNAP security advisories and apply any relevant updates or workarounds.

Remediation steps

Type	Step
Patch	Multiple Vulnerabilities in OpenSSL \| QSA-23-15 https://www.qnap.com/en/security-advisory/qsa-23-15
Patch	Vulnerability in sudo \| QSA-23-11 https://www.qnap.com/en/security-advisory/qsa-23-11
Patch	Vulnerability in QTS, QuTS hero, QuTScloud, QVP, and QVR \| QSA-23-10 https://www.qnap.com/en/security-advisory/qsa-23-10
Patch	Vulnerabilities in QTS, QuTS hero, QuTScloud, and QVP \| QSA-23-06 https://www.qnap.com/en/security-advisory/qsa-23-06
Patch	Buffer Overflow Vulnerability in Samba \| QSA-23-03 https://www.qnap.com/en/security-advisory/qsa-23-03
Patch	Buffer Overflow Vulnerabilities in Samba \| QSA-23-02 https://www.qnap.com/en/security-advisory/qsa-23-02

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2023-22809

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Status Published

CVE-2023-23355

A vulnerability has been reported to affect multiple QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute arbitrary commands via susceptible QNAP devices. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR. We have already fixed the vulnerability in the following operating system versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

Status Published

CVE-2022-42898

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Status Published

CVE-2022-3592

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

Status Published

CVE-2022-3437

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

Last edited: 30 March 2023 4:44 pm