QNAP recommends disabling the use of AFP as a mitigation until patches are available.
#NETATALK SYNOLOGY SOFTWARE#
Both companies are currently working on patches for the other affected software versions. build 20220419 and later, and Synology DSM version 7.1-42661-1 and later are protected.
#NETATALK SYNOLOGY UPDATE#
While Netatalk 3.1.13 was released to address these vulnerabilities, users will need to update their QNAP devices in order to remediate the vulnerable Netatalk versions.įollowing QNAP’s publication, on the 28th of April, Synology published a similar security advisory regarding the same Netatalk vulnerabilities affecting multiple versions of Synology’s DiskStation Manager and Router Manager.Īt the time of this writing only QNAP QTS version 4. In the meantime, they advise users to temporarily disable the AFP (which can be done through the devices’ control panel, under the Network & File Services tab) and to implement updates as soon as they are available.On the 25th of April 2022, QNAP published a security advisory regarding multiple vulnerabilities affecting Netatalk, which is an open-source implementation of the Apple Filing Protocol (AFP) used by QNAP devices so that they can act as a file server for macOS clients. build 20220419 and later and is working on other fixes. QNAP has fixed the vulnerabilities on QTS 4. Synology says that they are in the process of pushing out fixes – there’s one for Synology DiskStation Manager v7.1 out already – and that users who want immediate assistence to mitigate the risk of exploitation should contact the company’s technical support service. TrueNAS has fixed the issues in TrueNAS Core 12.0-U8.1, released earlier this month. “Users can continue to access local network shares and perform Time Machine backup via SMB,” they said. Western Digital reacted earlier this year, before the Netatalk update with fixes, by removing Netatalk from their firmware altogether.
#NETATALK SYNOLOGY CODE#
CVE-2022-23123 and CVE-2022-23124 – two sensitive information disclosure vulnerabilities.CVE-2022-0194, CVE-2022-23122, and CVE-2022-23125, which can be exploited to achieve unauthenticated remote code execution.
They have been patched in Netatalk v3.1.1 in March, but the new version has yet to be propagated to some of the affected devices. The vulnerabilities that are currently the problem were reported and some of them exploited at the Pwn2Own 2021 hacking competition. Vulnerabilities affecting some of the most widely used NAS devices are often exploited to covertly mine cryptocurrency or are compromised, their contents stolen or encrypted and held for ransom.
Also, they are often exposed to the public internet, making them also reachable to attackers. Network-attached storage (NAS) devices are usually used by small-to-medium businesses and home users for storing and sharing files and backups. There is no indication that they are currently being exploited by attackers in the wild, but until patches are made available, users should implement mitigations delineated by the companies. Users of Synology and QNAP network-attached storage (NAS) devices are advised to be on the lookout for patches for several critical vulnerabilities affecting Netatalk, an open-source implemention of the Apple Filing Protocol (AFP) that allows Unix-like operating systems to serve file servers for Macs.
0 kommentar(er)
