certfr_avis - certfr-2023-avi-0602

CERTFR-2023-AVI-0602

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Qnap. Elles permettent à un attaquant de provoquer un déni de service à distance et une exécution de code arbitraire.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	QVR	QVR Pro Appliance versions antérieures à 2.3.1.0476
Qnap	QTS	QTS versions antérieures à 4.5.4.2280 build 20230112
Qnap	QuTS hero	QuTS hero versions antérieures à h4.5.4.2374 build 20230417
Qnap	N/A	QVPN Device Client pour Windows versions antérieures à 2.0.0.1316
Qnap	N/A	QuTScloud versions antérieures à c5.0.1.2374 build 20230419
Qnap	QTS	QTS versions antérieures à 5.0.1.2277 build 20230112
Qnap	QuTS hero	QuTS hero versions antérieures à h5.0.1.2277 build 20230112

References

Title

Publication Time

Tags

Bulletin de sécurité Qnap QSA-23-04 du 28 juillet 2023	None	vendor-advisory
Bulletin de sécurité Qnap QSA-23-09 du 28 juillet 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVR Pro Appliance versions ant\u00e9rieures \u00e0 2.3.1.0476",
      "product": {
        "name": "QVR",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions ant\u00e9rieures \u00e0 4.5.4.2280 build 20230112",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions ant\u00e9rieures \u00e0 h4.5.4.2374 build 20230417",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QVPN Device Client pour Windows versions ant\u00e9rieures \u00e0 2.0.0.1316",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTScloud versions ant\u00e9rieures \u00e0 c5.0.1.2374 build 20230419",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions ant\u00e9rieures \u00e0 5.0.1.2277 build 20230112",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions ant\u00e9rieures \u00e0 h5.0.1.2277 build 20230112",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-27600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27600"
    },
    {
      "name": "CVE-2022-27595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27595"
    }
  ],
  "initial_release_date": "2023-07-28T00:00:00",
  "last_revision_date": "2023-07-28T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0602",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-07-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Qnap\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service \u00e0 distance et une ex\u00e9cution de code\narbitraire.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-04 du 28 juillet 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-04"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-23-09 du 28 juillet 2023",
      "url": "https://www.qnap.com/fr-fr/security-advisory/qsa-23-09"
    }
  ]
}

CVE-2022-27600 (GCVE-0-2022-27600)

Vulnerability from cvelistv5

Published

2024-12-19 01:39

Modified

2024-12-20 17:41

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

Summary

An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2277 and later QTS 4.5.4.2280 build 20230112 and later QuTS hero h5.0.1.2277 build 20230112 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

References

URL

Tags

https://www.qnap.com/en/security-advisory/qsa-23-09

Impacted products

Vendor

Product

Version

QNAP Systems Inc.

QTS

Version: 5.0.x < 5.0.1.2277
Version: 4.5.x < 4.5.4.2280 build 20230112

	QNAP Systems Inc.	QuTS hero	Version: h5.0.x < h5.0.1.2277 build 20230112 Version: h4.5.x < h4.5.4.2374 build 20230417
	QNAP Systems Inc.	QuTScloud	Version: c5.x.x < c5.0.1.2374

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-27600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-20T16:45:14.667432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-20T17:41:53.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "5.0.1.2277",
              "status": "affected",
              "version": "5.0.x",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.4.2280 build 20230112",
              "status": "affected",
              "version": "4.5.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h5.0.1.2277 build 20230112",
              "status": "affected",
              "version": "h5.0.x",
              "versionType": "custom"
            },
            {
              "lessThan": "h4.5.4.2374 build 20230417",
              "status": "affected",
              "version": "h4.5.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTScloud",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "c5.0.1.2374",
              "status": "affected",
              "version": "c5.x.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "huasheng_mangguo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2277 and later\u003cbr\u003eQTS 4.5.4.2280 build 20230112 and later\u003cbr\u003eQuTS hero h5.0.1.2277 build 20230112 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e"
            }
          ],
          "value": "An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2277 and later\nQTS 4.5.4.2280 build 20230112 and later\nQuTS hero h5.0.1.2277 build 20230112 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-212",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-212"
            }
          ]
        },
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554"
            }
          ]
        },
        {
          "capecId": "CAPEC-191",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-191"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T01:39:38.167Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-23-09"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.0.1.2277 and later\u003cbr\u003eQTS 4.5.4.2280 build 20230112 and later\u003cbr\u003eQuTS hero h5.0.1.2277 build 20230112 and later\u003cbr\u003eQuTS hero h4.5.4.2374 build 20230417 and later\u003cbr\u003eQuTScloud c5.0.1.2374 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.0.1.2277 and later\nQTS 4.5.4.2280 build 20230112 and later\nQuTS hero h5.0.1.2277 build 20230112 and later\nQuTS hero h4.5.4.2374 build 20230417 and later\nQuTScloud c5.0.1.2374 and later"
        }
      ],
      "source": {
        "advisory": "QSA-23-09",
        "discovery": "EXTERNAL"
      },
      "title": "QTS, QuTS hero, QuTScloud",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2022-27600",
    "datePublished": "2024-12-19T01:39:38.167Z",
    "dateReserved": "2022-03-21T22:02:33.327Z",
    "dateUpdated": "2024-12-20T17:41:53.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-27595 (GCVE-0-2022-27595)

Vulnerability from cvelistv5

Published

2024-12-19 01:39

Modified

2024-12-20 17:41

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427

Summary

An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QVPN Windows 2.0.0.1316 and later QVPN Windows 2.0.0.1310 and later

References

URL

Tags

https://www.qnap.com/en/security-advisory/qsa-23-04

Impacted products

	Vendor	Product	Version
	QNAP Systems Inc.	QVPN Windows	Version: 2.0.x < 2.0.0.1316 Version: 2.0.x < 2.0.0.1310

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-27595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-20T16:59:39.320965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-20T17:41:46.284Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QVPN Windows",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "2.0.0.1316",
              "status": "affected",
              "version": "2.0.x",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.1310",
              "status": "affected",
              "version": "2.0.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Runzi Zhao, Security Researcher, QI-ANXIN"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQVPN Windows 2.0.0.1316 and later\u003cbr\u003eQVPN Windows 2.0.0.1310 and later\u003cbr\u003e"
            }
          ],
          "value": "An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following versions:\nQVPN Windows 2.0.0.1316 and later\nQVPN Windows 2.0.0.1310 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-38",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-38"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T01:39:46.448Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-23-04"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQVPN Windows 2.0.0.1316 and later\u003cbr\u003eQVPN Windows 2.0.0.1310 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQVPN Windows 2.0.0.1316 and later\nQVPN Windows 2.0.0.1310 and later"
        }
      ],
      "source": {
        "advisory": "QSA-23-04",
        "discovery": "EXTERNAL"
      },
      "title": "QVPN Device Client",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2022-27595",
    "datePublished": "2024-12-19T01:39:46.448Z",
    "dateReserved": "2022-03-21T22:02:33.326Z",
    "dateUpdated": "2024-12-20T17:41:46.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2023-AVI-0602

Vulnerability from certfr_avis

Solution

CVE-2022-27600 (GCVE-0-2022-27600)

Vulnerability from cvelistv5

CVE-2022-27595 (GCVE-0-2022-27595)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature