Qnap Security Advisory | Bulletin ID: QSA-21-02

Qnap Systems, Inc. had published security enhancement against security vulnerabilities that could affect specific versions of the company’s products.

Use the following information and solutions to correct the security issues and vulnerabilities.

Heap-based buffer Overflow in Sudo (Baron Samedit)
Release date: January 28, 2021 
Security ID: QSA-21-02 
Severity rating: Medium 
CVE identifier: CVE-2021-3156 
Affected products: All Qnap NAS

Summary
The Qualys, Inc. research team has reported a heap-based buffer overflow vulnerability in sudo, an important utility for Unix-like and Linux-based operating systems, including QTS, QuTS hero, and QES from Qnap.

If exploited, this vulnerability allows any unprivileged users to gain escalated root privileges on the vulnerable host.

The company is thoroughly investigating the case. We will release security updates and provide further information as soon as possible.

Recommendation
To secure your device, we recommend disabling SSH and Telnet whenever you are not using these services.

Disabling SSH and Telnet connections in QTS or QuTS hero

1. Log on to QTS or QuTS hero as administrator.

2. Go to Control Panel > Network & File Services > Telnet/SSH.

3. Deselect Allow Telnet connection.

4. Deselect Allow SSH connection.

5. Click Apply.

Disabling SSH connections in QES

1. Log on to QES as administrator.

2. Go to Control Panel > Network & File Services > SSH.

3. Deselect Allow SSH connection.

4. Click Apply.

Revision History: V1.0 (January 28, 2021) – Published

Contact if questions regarding this issue