PT-2024-11895 · Synology · Synology Drive Client

Zhao Runzi · Published 2024-09-25 · Updated 2024-10-08 · CVE-2022-49041

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Synology Drive Client versions prior to 3.4.0-15721

Description A buffer copy without checking the size of the input, also known as a 'Classic Buffer Overflow', exists in the backup task management functionality. This issue allows local users with administrator privileges to crash the client via unspecified vectors.

Recommendations For versions prior to 3.4.0-15721, update to version 3.4.0-15721 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup task management functionality to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-49041

Affected Products

Synology Drive Client

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-49041 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49041 · Vendor Advisory
• https://synology.com/en-global/security/advisory/Synology_SA_24_10 · Vendor Advisory
• https://t.me/cvedetector/6375 · Telegram Post
• https://twitter.com/CVEnew/status/1839150704717607048 · Twitter Post
• https://t.me/cvenotify/97456 · Telegram Post