Synology Security Synology-SA-22:01 DSM

[Synology RSS]

Multiple vulnerabilities allow remote attackers, or remote authenticated users to inject arbitrary web script or HTML via a susceptible version of DiskStation Manager (DSM).

Continue reading...
- - -
Source: synology.com

 

[Telos]

I recommend waiting a month to install this update, due to Synology's egregious pattern of recalling updates and then re-releasing patched updates with the same build number.

When that happens, early adopters are unable to install the corrected patch. And we know that Synology's first patch release often introduce new deficiencies. I, for one, am stuck on a "release 2" version that was twice replaced. But I'll not repeat that, jumping to an early "release 3" build.

It's my hope that some here who have a relationship with Synology would use their influence to end this poor practice of releasing "patched" patches without advancing the build number.

 

[Robbie]

Too late for me - I've updated 3 machines already!

️

 

[Jan Janowski]

Agree with Mr. T. I have encountered just what he has explained!!! A couple times!
P.S.: This is the second time in a week that DSM or SRM updates are posted here, first -- before seen at Synology Forum!!

 

[Danabw]

Not even being offered on my DS218+ yet, haven't checked my DS212 yet.

 

[Rusty]

DSM7 machines all patched with no problem. DSM6 (918) with current UP2 patch on it, didn't request a reboot even with this UP3

 

[Telos]

Not even being offered on my DS218+ yet

Install manually if you must have it

 

[Danabw]

Install manually if you must have it

Nope, not in a rush, just noting that it appears to be rolling out gradually.

 

[Telos]

it appears to be rolling out gradually

Standard practice for all Synology releases.

 

[Jan Janowski]

I’m watching for your posts Mr T!

 

[Telos]

Again, Synology has hosed "early adopters" by withdrawing the latest update patch.

 

[Rusty]

That’s why you don’t patch production on day 1

 

[fredbert]

That’s why you don’t patch production on day 1

The irony being that for security patches you should be implementing them fairly smart-ish on production devices, after testing on non-production devices, if they are exposed by the vulnerabilities.

 

[leriak]

Again, Synology has hosed "early adopters" by withdrawing the latest update patch.

Oh boy, it didn't take even a full day before they pulled the update...

Synology Community

Hi! Come and join us at Synology Community. A place to answer all your Synology questions. Ask a question or start a discussion now.

community.synology.com

 

[Rusty]

The irony being that for security patches you should be implementing them fairly smart-ish on production devices, after testing on non-production devices, if they are exposed by the vulnerabilities.

Agreed, but due to recent MO by Syno when it comes to their patches, I never put new patches on day1 on PROD... just in case. Can't shake the feeling that this new "will be deployed in different regions..." policy means, let's buy some weeks by pushing the patch to the masses and see what will go wrong. Then we will patch some more and then we will do a mass rollout.

 

[fredbert]

Well indeed. It's definitely worth reading the release notes to determine if it relates to anything you use... if you don't use a fixed/patched feature then probably it's worth not updating, at least not right away.

You know those bugs when the male often gets eaten by its mate:

• The bug is us
• The mate is Synology's software release and QA
• And the rest of the bug eating world are hackers

 

[Rusty]

if you don't use a fixed/patched feature then probably it's worth not updating

Exactly. This is my mindset as well. I only patch if there are obvious security problems that might bite me, and features that I might use/were fixed.

Nothing but to sit and wait now.

 

[Telos]

Oh my! Update 2!

Did Synology hear from our forum? A new update! Imagine that.

 

[Rusty]

Oh my! Update 2!

Did Synology hear from our forum? A new update! Imagine that.

It is, but UP1 is also back... Still UP2 is here. Luckly I was sitting down

 

[Telos]

It is, but UP1 is also back... Still UP2 is here. Luckly I was sitting down

Haha. So the new U1 replaced the old U1. Some things never change