Multiple vulnerabilities in Synology DiskStation Manager (DSM)

1) Cleartext transmission of sensitive information

EUVDB-ID: #VU52348

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-26560

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information within the synoagentregisterd server finder functionality. A remote attacker can perform a man-in-the-middle attack and gain access to sensitive data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU52349

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-26561

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing "syno_finder_site" HTTP header. A remote unauthenticated attacker can perform a man-in-the-middle attack, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU52350

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-26562

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing "syno_finder_site" HTTP header. A remote attacker can perform a man-in-the-middle attack, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1159

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU52351

Risk: Low

CVSSv4.0: 2.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-26563

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in AppArmor’s synosearchagent profile. A local administrator can use a specially crafted kernel module to bypass the AppArmor’s restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1158

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cleartext transmission of sensitive information

EUVDB-ID: #VU52352

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-26564

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information in synorelayd. A remote attacker can perform a man-in-the-middle attack to spoof servers via an HTTP session.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cleartext transmission of sensitive information

EUVDB-ID: #VU52353

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-26565

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information in synorelayd. A remote attacker can perform a man-in-the-middle attack to obtain sensitive information via an HTTP session.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Command Injection

EUVDB-ID: #VU52354

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-26566

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to insertion of sensitive information into sent data issue in synorelayd. A remote attacker can perform a man-in-the-middle attack to execute arbitrary commands via inbound QuickConnect traffic.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

DiskStation Manager (DSM): 6.2.3 25426-2

CPE2.3

• cpe:2.3:a:synology:diskstation_manager_dsm:6.2.3:25426-2:*:*:*:*:*:*

External links

http://www.synology.com/security/advisory/Synology_SA_20_26
http://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1160

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.