Alert GCSA-24144 - Vulnerabilita' critiche in NAS QNAP

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

alert ID: GCSA-24144
data: 31 ottobre 2024
titolo: Vulnerabilita' critiche in NAS QNAP

******************************************************************

:: Descrizione del problema

QNAP ha corretto due vulnerabilita' critiche di tipo zero-day, sfruttate da
dei ricercatori di sicurezza durante l'hacking contest Pwn2Own Ireland 2024.

Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

CVE-2024-50387

SMB Service before version 4.15.002
SMB Service before version h4.15.002

CVE-2024-50388

HBS 3 Hybrid Backup Sync before version 25.1.1.673


:: Impatto

Esecuzione remota di codice arbitrario (RCE)
Bypass delle funzionalita' di sicurezza (SFB)


:: Soluzioni

Aggiornare i prodotti alle ultime versioni
https://www.qnap.com/en/security-advisory/qsa-24-41
https://www.qnap.com/en/security-advisory/qsa-24-42


:: Riferimenti

QNAP Security Advisory:
https://www.qnap.com/en/security-advisories

Bleeping Computer
https://www.bleepingcomputer.com/news/security/qnap-synology-lexmark-devices-hacked-on-pwn2own-day-3/
https://www.bleepingcomputer.com/news/security/qnap-fixes-nas-backup-software-zero-day-exploited-at-pwn2own/
https://www.bleepingcomputer.com/news/security/qnap-patches-second-zero-day-exploited-at-pwn2own-to-get-root/

SecurityWeek
https://www.securityweek.com/synology-qnap-truenas-address-vulnerabilities-exploited-at-pwn2own-ireland/

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50387
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50388


GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iGsEAREIACsWIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZyPHYw0cY2VydEBnYXJy
Lml0AAoJEMGcTJNlEmBCd5IAoMjuGFPZ4loTAMiKH/R/lAIT1/uIAJwMWIe52ijK
fGoAjoGJKM5J8Jy79A==
=Fuyx
-----END PGP SIGNATURE-----