PT-2015-5936 · Synology · Cloud Station

Jeremy Kemp · Publicado 2015-05-30 · Atualizado 2016-12-03 · CVE-2015-2851

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology Cloud Station versions 1.1-2291 through 3.1-3320

Description The issue allows local users to change the ownership of arbitrary files and consequently obtain root access by specifying a filename. This is related to the client chown functionality in the sync client.

Recommendations For versions 1.1-2291 through 3.1-3320, consider restricting access to the client chown function to prevent unauthorized changes to file ownership until a fix is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-2851

Produtos afetados

Cloud Station

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-2851 · Nota de Segurança
• http://kb.cert.org/vuls/id/551972 · Nota
• http://securityfocus.com/bid/74826 · Nota
• http://kb.cert.org/vuls/id/BLUU-9VBU45 · Nota