[SECURITY ADVISORY] Vulnerability in Music Station

Introduce yourself to us and other members here, or share your own product reviews, suggestions, and tips and tricks of using QNAP products.
Post Reply
User avatar
Toxic17
Ask me anything
Posts: 6468
Joined: Tue Jan 25, 2011 11:41 pm
Location: Planet Earth
Contact:

[SECURITY ADVISORY] Vulnerability in Music Station

Post by Toxic17 »

Improper Access Control Vulnerability in Music Station
  • Release date: May 6, 2021
  • Security ID: QSA-21-08
  • Severity: High
  • CVE identifier: CVE-2020-36197
  • Affected products: QNAP NAS running Music Station
  • Status: Resolved
Summary
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
We have already fixed this vulnerability in the following versions:
  • QTS 4.5.2: Music Station 5.3.16 and later
  • QTS 4.3.6: Music Station 5.2.10 and later
  • QTS 4.3.3: Music Station 5.1.14 and later
  • QuTS hero h4.5.2: Music Station 5.3.16 and later
  • QuTScloud c4.5.4: Music Station 5.3.16 and later
Recommendation
To fix the vulnerability, we recommend updating Music Station to the latest version.
Updating Music Station
  1. Log on to QTS or QuTS hero as administrator.
  2. Open the App Center and then click Image .
    A search box appears.
  3. Type “Music Station” and then press ENTER.
    Music Station appears in the search results.
  4. Click Update.
    A confirmation message appears.
    Note: The Update button is not available if your Music Station is already up to date.
  5. Click OK.
    The application is updated.
Acknowledgements: polict of Shielder working with Trend Micro’s Zero Day Initiative
Revision History:
V2.1 (May 14, 2021) - Update Acknowledgements
V1.0 (May 13, 2021) - Update Status, Severity, CVE ID, Summary and Acknowledgments
V1.0 (May 6, 2021) - Published
User avatar
Toxic17
Ask me anything
Posts: 6468
Joined: Tue Jan 25, 2011 11:41 pm
Location: Planet Earth
Contact:

Re: [SECURITY ADVISORY] Vulnerability in Music Station

Post by Toxic17 »

updated OP
Regards Simon

Qnap Downloads
MyQNap.Org Repository
Submit a ticket • QNAP Helpdesk
QNAP Tutorials, User Manuals, FAQs, Downloads, Wiki
When you ask a question, please include the following


NAS: TS-673A QuTS hero h5.1.2.2534 • TS-121 4.3.3.2420 • APC Back-UPS ES 700G
Network: VM Hub3: 500/50 • UniFi UDM Pro: 3.2.9 • UniFi Network Controller: 8.0.28
USW-Aggregation: 6.6.61 • US-16-150W: 6.6.61 • 2x USW Mini Flex 2.0.0 • UniFi AC Pro 6.6.62 • UniFi U6-LR 6.6.62
UniFi Protect: 2.11.21/8TB Skyhawk AI • 3x G3 Instants: 4.69.55 • UniFi G3 Flex: 4.69.55 • UniFi G5 Flex: 4.69.55
User avatar
Toxic17
Ask me anything
Posts: 6468
Joined: Tue Jan 25, 2011 11:41 pm
Location: Planet Earth
Contact:

Re: [SECURITY ADVISORY] Vulnerability in Music Station

Post by Toxic17 »

V2.1 (May 14, 2021) - Update Acknowledgements
Regards Simon

Qnap Downloads
MyQNap.Org Repository
Submit a ticket • QNAP Helpdesk
QNAP Tutorials, User Manuals, FAQs, Downloads, Wiki
When you ask a question, please include the following


NAS: TS-673A QuTS hero h5.1.2.2534 • TS-121 4.3.3.2420 • APC Back-UPS ES 700G
Network: VM Hub3: 500/50 • UniFi UDM Pro: 3.2.9 • UniFi Network Controller: 8.0.28
USW-Aggregation: 6.6.61 • US-16-150W: 6.6.61 • 2x USW Mini Flex 2.0.0 • UniFi AC Pro 6.6.62 • UniFi U6-LR 6.6.62
UniFi Protect: 2.11.21/8TB Skyhawk AI • 3x G3 Instants: 4.69.55 • UniFi G3 Flex: 4.69.55 • UniFi G5 Flex: 4.69.55
Post Reply

Return to “Users' Corner”