PT-2024-14784 · Synology · Synology Drive Client

Zhao Runzi · Published 2024-09-25 · Updated 2024-10-08 · CVE-2023-52946

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Synology Drive Client versions prior to 3.5.0-16084

Description A buffer copy without checking the size of the input, also known as a 'Classic Buffer Overflow', exists in the vss service component. This allows remote attackers to overwrite buffers and crash the client via unspecified vectors.

Recommendations For versions prior to 3.5.0-16084, update to version 3.5.0-16084 or later to resolve the issue. As a temporary workaround, consider restricting access to the vss service component until a patch is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-52946

Affected Products

Synology Drive Client

References · 8

• https://osv.dev/vulnerability/CVE-2023-52946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52946 · Security Note
• https://synology.com/en-global/security/advisory/Synology_SA_24_10 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1839178636693270967 · Twitter Post
• https://twitter.com/cracbot/status/1840995109384700173 · Twitter Post
• https://t.me/cvenotify/97457 · Telegram Post
• https://twitter.com/CVEnew/status/1839150710564467072 · Twitter Post
• https://t.me/cvedetector/6376 · Telegram Post