Synology Security Synology-SA-24:01 DSM

[Synology RSS]

A vulnerability allows local users to execute arbitrary code via a susceptible version of Synology DiskStation Manager (DSM).

Continue reading...
- - -
Synology Product Security Advisory: check the list

Source: synology.com

 

[ChAlb]

Well DSM 7.1 is subject to this vulnerability and the fix is only available in 7.2 which is not available for all NAS model… some NAS are stuck in 7.1 but still on a supported version of DSM 7.1. Hope they will provide a fix for 7.1

 

[Telos]

some NAS are stuck in 7.1

But seriously... Is this specific "vulnerability" really such a big deal? Is it likely to happen to you? How would that occur? What would be the specific consequence? Do you have the same concern for your phone? PC?

Just trying to keep things in perspective.

 

[ChAlb]

But seriously...
Do you have the same concern for your phone? PC?

Of course not !
I patch only if a vulnerability is discovered an even day of an odd month in a leap year.

 

[Jan Janowski]

After reading about it, I spent time trying to determine if a new DSM had just come out, that I missed, and then, why this wasn't posted at the time 7,2 came out... ?

 

[Patrick]

7.2 first came out last November 2023 I think.
My system is on Automatic update. It's never failed in 10+ years.

 

[fredbert]

I also noted that the initial remediation for all versions of DSM was to install DSM 7.2-64561. However, I just checked the advisory page just now and DSM 6.2 and 7.1 remediation has been changed to 'ongoing'. So hopefully there will be a fix for this vulnerability within these DSM versions.

I also noted the vulnerability was stated as being from local users. It's not clear what 'local' means as it could mean users accessing from the local network, or it could be DSM local accounts (as opposed to directory accounts). My working assumption is that the vulnerability is exposed via authenticated (logged in) DSM local account users, regardless of from where they are accessing the NAS. There's no other information of how or which services/applications have the vulnerability, it says DSM so it could be limited to the Web interfaces (a malformed API call? for an already authenticated user?).

If you trust your users and enable stronger authentication methods then there it is probably [repeat probably] ok to wait for a fix.