QNAP Works on Patches for OpenSSL Bugs Affecting NAS Devices

Share post:

Network-attached storage (NAS) maker QNAP is working on security updates to patch remote code execution and denial-of-service (DoS) vulnerabilities.

The security vulnerabilities traced as CVE-2021-3711 and CVE-2021-3712 affect QNAP NAS devices running QTS, QuTS hero, QuTScloud and HBS 3 Hybrid Backup Sync as backup and disaster recovery apps.

The heap-based buffer overflow in the SM2 cryptographic algorithm behind CVE-2021-3711 might potentially lead to crashes and the execution of arbitrary code by threat actors.

The CVE-2021-3712 vulnerability is caused by a read buffer overrun weakness while processing ASN.1 strings, which could be exploited by hackers to crash vulnerable apps or gain entry to private memory contents such as private keys or similar sensitive information.

As QNAP explains, the vulnerabilities allow remote attackers, if successfully exploited, to obtain unauthorized access to memory data, trigger DoS states, or execute arbitrary code with the privileges of the user running the HBS 3 app.

For more information, view the original story from Bleeping Computer.

SUBSCRIBE NOW

Related articles

FBI rapidly hacks into Trump shooter’s phone, raises privacy concerns

Just two days after the attempted assassination at a Trump rally, the FBI announced it had gained access...

Disney investigating a potential major leak of internal communications

Disney is investigating a significant data breach by the hacking group Nullbulge, which claims to have accessed and...

Kaspersky to shut down its US business due to sanctions

Russian cybersecurity firm Kaspersky Lab announced it will cease its U.S. operations starting July 20, following sanctions from...

Google’s Gemini AI caught scanning private Google Drive documents without permission

Google's Gemini AI has come under fire for scanning private PDF documents in Google Drive without user consent....

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways