SB2025090240 - Multiple vulnerabilities in QNAP QTS and QuTS hero

Description

This security bulletin contains information about 6 secuirty vulnerabilities.

1) Type Confusion (CVE-ID: CVE-2023-42464)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the dalloc_value_for_key() function when parsing Spotlight RPC packets. A remote attacker can send specially crafted Spotlight RPC packets to the application, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Arbitrary file upload (CVE-ID: CVE-2022-22995)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the combination of primitives offered by SMB and AFP in their default configuration. A remote attacker can upload a malicious file and execute it on the server.

3) Heap-based buffer overflow (CVE-ID: CVE-2022-45188)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in afp_getappl when handling .appl files. A remote attacker can create a specially crafted .appl file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Off-by-one (CVE-ID: CVE-2024-38439)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the setting ibuf[PASSWDLEN] to "\0" in FPLoginExt in login in etc/uams/uams_pam.c. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Off-by-one (CVE-ID: CVE-2024-38440)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the FPLoginExt in BN_bin2bn in etc/uams/uams_dhx_pam.c. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Off-by-one (CVE-ID: CVE-2024-38441)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error within the ibuf[len] to "\0" in FPMapName in afp_mapname in etc/afpd/directory.c. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.qnap.com/en/security-advisory/qsa-25-23