QNAP Security Advisory: Samba Writable Share Vulnerability

[thiggins]

Security Advisory for Samba Writable Share Vulnerability
Release date: May 27, 2017
Last updated: May 27, 2017
Bulletin ID: NAS-201705-27
Severity rating: High
CVE identifier: CVE-2017-7494
Affected products: All NAS running QTS

Summary
The Samba team has released an advisory for CVE-2017-7494, a vulnerability that may allow users with write access to upload a shared library to a writeable shared folder and then execute malicious code.

Solution
QNAP is currently working on a fix and will release an update in the coming days. For manually applying a workaround, refer to QNAP Forum ( https://forum.qnap.com/viewtopic.php?f=5&t=132991&p=617561#p617561)

References:
https://www.samba.org/samba/security/CVE-2017-7494.html
https://www.samba.org/samba/history/security.html
https://access.redhat.com/security/cve/CVE-2017-7494

If you have any questions regarding this issue, please contact us at http://helpdesk.qnap.com/.

 

[sfx2000]

Thx for posting - the hot-fix is a bit complicated for most after reviewing the forum post on QNAP's forums...

Defense in depth is always a good thing - don't expose shares to the outside world, and even inside, disable any kind of "guest" shares there - most NAS boxes do restrict user accounts - so the threat is actually windows on the desktop for sharing (which I don't, even for homegroups)

Doesn't just apply to QNAP and QTS, but anything that does Samba on the LAN - which includes many Router/AP's there...

 

[thiggins]

Update posted 6/2

QNAP Releases Qfixes for Samba Writable Share Vulnerability

Taipei, Taiwan, June 2, 2017 – The administrators of the open-source software Samba have disclosed a vulnerability in their software, which can be used to execute malicious code on affected devices. QNAP® Systems, Inc is committed to protecting the privacy and data security of our users and has released Qfixes for QNAP NAS to patch this vulnerability. QNAP urges users to install these Qfixes on their QNAP NAS to protect against unauthorized access.

Samba is a network protocol for file and printer sharing. The CVE-2017-7494 remote code execution vulnerability allows clients with write permission to upload a shared library to a shared folder, and then cause the server to load and execute it. By utilizing this exploit, malicious users can run any code on remote servers and obtain administrator privileges. QNAP has provided separate Qfixes for QTS version 4.3.x and 4.2.x. QNAP recommends that users update QTS to the latest version available for their NAS, and then install the Qfix.

To learn more about how QNAP safeguards cyber security, please visit QNAP Security Bulletins and Advisories.