Synology Security Synology-SA-23:07 DSM

[Synology RSS]

A vulnerability allows remote attackers to obtain user credential via a susceptible version of Synology DiskStation Manager (DSM).

Continue reading...
- - -
Synology Product Security Advisory: check the list

Source: synology.com

 

[fredbert]

This and the other three security advisories posted at the same time would seem to point to that fact that we are all now being pushed to use the latest DSM and SRM. To summarise the responses.

OS version	Vulnerability response	… or this
DSM 7.2	Fixed in version XYZ of 7.2
DSM 7.1	Fixed in version XYZ of 7.1	Will not fix
DSM 7.0	Will not fix
DSM 6.2	Will not fix
SRM 1.3	Ongoing
SRM 1.2	Will not fix

Synology Product Security Advisory | Synology Inc.

Synology Product Security Advisory

www.synology.com

 

[Jan Janowski]

So far 7.2 is working fine here
Will be watching for update on SRM

 

[Rusty]

This and the other three security advisories posted at the same time would seem to point to that fact that we are all now being pushed to use the latest DSM and SRM. To summarise the responses.

OS version	Vulnerability response	… or this
DSM 7.2	Fixed in version XYZ of 7.2
DSM 7.1	Fixed in version XYZ of 7.1	Will not fix
DSM 7.0	Will not fix
DSM 6.2	Will not fix
SRM 1.3	Ongoing
SRM 1.2	Will not fix

Synology Product Security Advisory | Synology Inc.

Synology Product Security Advisory

www.synology.com

Saw this a few days ago and said to myself “well that’s one way off pushing people to get the latest software and buy x15 or better models”.

“will not fix” bumper sticker right there!

 

[Telos]

“will not fix” bumper sticker right there!

Most of these security issues are quite obscure and unlikely to affect the average user. Still, I'd like to see my v6.24 installation patched if the cure is not worse than the disease.

 

[fredbert]

I've not looked further into the vulnerabilities, but it was the 'will not fix' even for DSM 7.1 that was a surprise. DSM 7.1 was a last update point for a few NAS models and to so quickly stop security patching seems a little premature. It sort of begs the question: why didn't Synology just cut those models out of DSM 7 completely?

 

[Jan Janowski]

Question. (For those with “Will not Fix” NAS’s…).

If they fix SRM, and unfixed DSM is behind the fixed SRM. Is DSM safe??

Doesn’t affect me—just nosy!

 

[Telos]

Probably not. Generally they are for account takeover. Those devices are separate.

 

[Jan Janowski]

Last question, promise

If someone with unfixed DSM only uses Quick Connect for external access, behind fixed SRM, any different?
(I’m asking this to learn more on the strengths of QuickConnect (3rd party connect) over open ports)

 

[fredbert]

I’m not sure they have released the details of the vulnerabilities and successful exploitations. It could be that just having access to the NAS means they are potentially at risk.

I was wondering if placing behind the proxy might afford a little protection from malformed requests. But I don’t think it will, especially if it the vulnerability is a weak routine that’s part of the security mechanism that is called by but isn’t part of the network interface per se.

 

[Jan Janowski]

Just realized that my neighbor with 2600 with V1.2.x will have to upgrade..... Alerted him....
That's certainly an incentive to upgrade.... Here's where having 2x 2600's is a good thing!