[Security] - QTS path traversal attack with AFP and OSX - CVE-2015-6003

[sfx2000]

Vulnerability Note VU#751328

QNAP QTS is vulnerable to a path traversal attack when used with the AFP protocol and OS X

Description:

CWE-23: Relative Path Traversal - CVE-2015-6003

When the Apple Filing Protocol (AFP) is enabled, any OS X user account (including the unauthenticated guest account) may be able to read and write arbitrary files on the QNAP QTS device.

According to documentation, AFP is disabled by default on the device, so only users specifically enabling this service are impacted.

According to the reporter, the TS-420 with firmware version prior to 4.1.4 Build 0910 is vulnerable. It is likely that all devices running firmware version 4.1.4 are affected; previous firmware versions may also be affected.

For more information, please see QNAP's security advisory.

Impact
An unauthenticated remote user may be able to read and write arbitrary files on the device.

Solution
Update the firmware

QNAP has released firmware version QTS 4.1.4 Build 0910 and QTS 4.2.0 Build 0910(RC2) to address this issue. Affected users are encouraged to update as soon as possible.

 

[L&LD]

QTS 4.2 Build 0925 is final. QTS 4.1.4 was last updated over a month ago (the 0910 build you're addressing).

Would not recommend to use any of the early RC builds for 4.2 today.

 

[sfx2000]

The 4.1.4 most recent update, along with the 4.2 general release have the fixes...

I would also think that if AFP is not enabled, this likely isn't a problem.