SoftNAS no longer a soft touch for hackers (for now)... Remote-hijacking vulnerability patched

guest · Jul 30, 2018

SoftNAS no longer a soft touch for hackers (for now)... Remote-hijacking vulnerability patched
July 30, 2018
https://www.theregister.co.uk/2018/07/30/softnas_vuln_patched/

SoftNAS has plugged a serious vulnerability in its cloud storage management tool that can be exploited to execute malicious code on a victim's server.

Core Security's Fernando Díaz and Fernando Catoira discovered the command-injection security flaw in the StorageCenter component of SoftNAS Cloud version pre-4.0.3. The programming blunder can be abused by an unauthenticated attacker to execute arbitrary system commands on the management server with root permissions.

The bug (CVE-2018-14417) lies in the software's mechanism for checking for updates: it does not perform session nor authentication verification, and does not sanitize its user-supplied inputs.

The associated release notes briefly refer to a security fix alongside performance improvements bundled with the release.
Click to expand...

Log in or Sign up

SoftNAS no longer a soft touch for hackers (for now)... Remote-hijacking vulnerability patched

guest Guest

Log in or Sign up

SoftNAS no longer a soft touch for hackers (for now)... Remote-hijacking vulnerability patched

guest Guest

Useful Searches