bugtraq - Command injection vulnerability in Synology Photo Station

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <556334AD.1090803@securify.nl>
Date: Mon, 25 May 2015 16:41:49 +0200
From: "Securify B.V." <lists@...urify.nl>
To: bugtraq@...urityfocus.com
Subject: Command injection vulnerability in Synology Photo Station

------------------------------------------------------------------------
Command injection vulnerability in Synology Photo Station
------------------------------------------------------------------------
Han Sahin, May 2015

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A command injection vulnerability was found in Synology Photo Station,
which allows an attacker to execute arbitrary commands with the
privileges of the webserver. An attacker can use this vulnerability to
compromise a Synology DiskStation NAS, including all data stored on the
NAS.

------------------------------------------------------------------------
Tested version
------------------------------------------------------------------------
This issue was tested on Synology Photo Station version 6.2-2858.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Synology reports that this issue has been resolved in Photo Station
version 6.3-2945.
https://www.synology.com/en-us/releaseNote/PhotoStation

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20150502/command_injection_vulnerability_in_synology_photo_station.html