PT-2015-7106 · Qnap+1 · Qnap Qts+2

Marcin Ochab · Publicado 2015-10-16 · Atualizado 2016-12-08 · CVE-2015-6003

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.1.4 build 0910 QNAP QTS versions 4.2.x prior to 4.2.0 RC2 build 0910

Description A directory traversal issue exists when AFP is enabled, allowing remote attackers to read or write to arbitrary files by leveraging access to an OS X user or guest account.

Recommendations For QNAP QTS versions prior to 4.1.4 build 0910, update to version 4.1.4 build 0910 or later. For QNAP QTS versions 4.2.x prior to 4.2.0 RC2 build 0910, update to version 4.2.0 RC2 build 0910 or later. As a temporary workaround, consider disabling AFP until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-6003

Produtos afetados

Afp

Os X

Qnap Qts

Referências · 4

• http://securitytracker.com/id/1033794 · Nota
• https://qnap.com/i/en/support/con_show.php?cid=85 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6003 · Nota de Segurança
• http://kb.cert.org/vuls/id/751328 · Nota