Taipei, Taiwan, January 28, 2021 - QNAP® had published security enhancement against security vulnerabilities that could affect specific versions of QNAP products.
Please use the following information and solutions to correct the security issues and vulnerabilities.
Heap-Based Buffer Overflow in Sudo (Baron Samedit)
Release date: January 28, 2021
Security ID: QSA-21-02
Severity rating: Medium
CVE identifier: CVE-2021-3156
Affected products: All QNAP NAS
Summary
The Qualys research team has reported a heap-based buffer overflow vulnerability in sudo, an important utility for Unix-like and Linux-based operating systems, including QTS, QuTS hero, and QES from QNAP.
If exploited, this vulnerability allows any unprivileged users to gain escalated root privileges on the vulnerable host.
QNAP is thoroughly investigating the case. We will release security updates and provide further information as soon as possible.
Recommendation
To secure your device, we recommend disabling SSH and Telnet whenever you are not using these services.
Disabling SSH and Telnet Connections in QTS or QuTS hero
- Log on to QTS or QuTS hero as administrator.
- Go to Control Panel > Network & File Services > Telnet/SSH.
- Deselect Allow Telnet connection.
- Deselect Allow SSH connection.
- Click Apply.
- Log on to QES as administrator.
- Go to Control Panel > Network & File Services > SSH.
- Deselect Allow SSH connection.
- Click Apply.
Revision History: V1.0 (January 28, 2021) - Published
If you have any questions regarding this issue, please contact us at https://www.qnap.com/go/support-ticket/.