PT-2017-12338 · Synology · Synology Dns Server

Publicado 2017-08-24 · Atualizado 2019-10-09 · CVE-2017-12074

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synology DNS Server versions prior to 2.2.1-3042

Description The issue allows remote authenticated attackers to write arbitrary files via the domain name parameter in the SYNO.DNSServer.Zone.MasterZoneConf. This can be exploited by sending a request to a vulnerable API endpoint with a specially crafted domain name parameter.

Recommendations For versions prior to 2.2.1-3042, update to version 2.2.1-3042 or later to resolve the issue. As a temporary workaround, consider restricting access to the SYNO.DNSServer.Zone.MasterZoneConf to minimize the risk of exploitation. Avoid using the domain name parameter in the affected API endpoint until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-12074

Produtos afetados

Synology Dns Server

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-12074 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12074 · Aviso do Fabricante
• https://synology.com/en-global/support/security/Synology_SA_17_46_DNS_Server · Aviso do Fabricante