PT-2015-5936 · Synology · Cloud Station

Jeremy Kemp · Published 2015-05-30 · Updated 2016-12-03 · CVE-2015-2851

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology Cloud Station versions 1.1-2291 through 3.1-3320

Description The issue allows local users to change the ownership of arbitrary files and consequently obtain root access by specifying a filename. This is related to the client chown functionality in the sync client.

Recommendations For versions 1.1-2291 through 3.1-3320, consider restricting access to the client chown function to prevent unauthorized changes to file ownership until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-2851

Affected Products

Cloud Station

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-2851 · Security Note
• http://kb.cert.org/vuls/id/551972 · Note
• http://securityfocus.com/bid/74826 · Note
• http://kb.cert.org/vuls/id/BLUU-9VBU45 · Note