Taipei, Taiwan, October 05, 2017 - QNAP® had published security enhancement against security vulnerabilities that could affect specific versions of QNAP products. Please use the following information and solutions to correct the security issues and vulnerabilities.
Security Advisory for Command Injection in Music Station
Release date: 2017/10/05
Last updated: 2017/10/05
Security ID: NAS-201710-05
Severity rating: High
CVE identifier: CVE-2017-13069
Affected products: Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
Summary
Security researcher Yoni Ramon discovered a number of command injection vulnerabilities found in Music Station. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS. QNAP acknowledges Mr. Ramon’s discovery and appreciates his efforts.
QNAP has already patched these vulnerabilities in Music Station versions 4.8.7 and 5.0.8.
Solution
To resolve the issue, you must update your Music Station to the latest version:
- For QTS 4.2.x: Music Station 4.8.7
- For QTS 4.3.x: Music Station 5.0.8
Upgrading to Music Station 4.8.7 or 5.0.8
- Log on to QTS as administrator.
- Open the App Center, and then click the Search icon.
A search box appears.
- Type “Music Station”, and then press ENTER.
The Music Station application appears in the search results list.
- Click Update.
A confirmation message appears.
- Click OK.
The application is updated.
If you have any questions regarding this issue, please contact us at
http://helpdesk.qnap.com/.