Synology 的用家記得update firmware

sp4148

原來synology 有個比人發現了幾年smb 保安漏洞， 大家記得update firmware

https://devco.re/blog/2022/03/28/your-NAS-is-not-your-NAS-en/


"Two years ago, we found a critical vulnerability, CVE-2021-31439, on Synology NAS. This vulnerability can let an unauthorized attacker gain code execution on remote Synology DiskStation NAS server. We used this vulnerability to exploit Synology DS418play NAS in Pwn2Own Tokyo 2020. After that, we found the vulnerability is not only exists on Synology but also on most NAS vendors. Following we will describe the details and how we exploit it."

觀星是答案

the vulnerability is not only exists on Synology but also on most NAS vendors.

其他廠都中

666

Up咩firmware? Q記打手？ 呢個問題係2020年，Q記每幾個月就奶一次，又要拉人地落水？

S既samba fix, 已經係半年前就做左...

Q記既問題唔係新，13年前一早係咁，當時問題仲大，根本從來未掂過。用過2隻Q之後永遠black list佢

sp4148

2020年俾黑客搵到，
2022年3月尾仲未fix 個 bug,
個作者當時測試重搵到個bug存在，
最近的 firmware 就已經fixed了
不過我部舊嘢都仲用緊6.2.4， 其實唔放出街是冇問題的

tphk98

6.2.4  update 6  fix  左samba 的bug  未？

sp4148

回覆 5# tphk98


    it's ok!

Product        Severity        Fixed Release Availability
DSM 7.1        Critical        Upgrade to 7.1-42661-1 or above.
DSM 7.0        Critical        Upgrade to 7.0.1-42218-4 or above.
DSM 6.2        Critical        Upgrade to 6.2.4-25556-6 or above.

sp4148

呢幾個firmware 已經fix埋AFP安全漏洞,
即係SMB外的另一 個安全漏洞

P166

回覆 3# 666


咁大反應做乜
開口埋口就話人地打手
我又睇唔出佢有洗白垃圾Qnap