¡¾Â©¶´Í¨¸æ¡¿QNAP QTS & QuTS HeroÔÐÍÎÛȾ©¶´£¨CVE-2023-39296£©
Ðû²¼Ê±¼ä 2024-01-09Ò»¡¢Â©¶´¸ÅÊö
©¶´Ãû³Æ | QNAP QTS & QuTS HeroÔÐÍÎÛȾ©¶´ | ||
CVE ID | CVE-2023-39296 | ||
©¶´ÀàÐÍ | ÔÐÍÎÛȾ | ·¢ÏÖʱ¼ä | 2024-01-09 |
©¶´ÆÀ·Ö | 7.5 | ©¶´Æ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | ÎÞ |
ÀûÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ֪ | ÔÚÒ°ÀûÓà | δ֪ |
QNAP Systems, Inc.£¨ÍþÁªÍ¨¿Æ¼¼£©Ö÷ÒªÉú²úÓÃÓÚÎļþ¹²Ïí¡¢ÐéÄ⻯¡¢´æ´¢¹ÜÀíºÍ¼à¿ØÓ¦ÓõÄÍøÂ總¼Ó´æ´¢£¨NAS£©É豸¡£
2024Äê1ÔÂ9ÈÕ£¬¶«Éƽ̨VSRC¼à²âµ½Ä³Ð©QNAP²Ù×÷ϵͳÖÐÐÞ¸´ÁËÒ»¸öÔÐÍÎÛȾ©¶´£¨CVE-2023-39296£©£¬ÆäCVSSv3ÆÀ·ÖΪ7.5¡£¸Ã©¶´Ó°ÏìÁËQTS ºÍ QuTS Hero£¬¿ÉÄܵ¼ÖÂÔ¶³ÌÍþвÕßʹÓÃÀàÐͲ»¼æÈݵÄÊôÐÔÁýÕÖÏÖÓÐÊôÐÔ£¬´Ó¶ø¿ÉÄܵ¼ÖÂϵͳÍ߽⡣
´ËÍ⣬QTS ºÍ QuTS HeroÖл¹ÐÞ¸´ÁËÒ»¸öOSÃüÁî×¢Èë©¶´£¨CVE-2023-39294£¬ÖÐΣ£©£¬¾¹ýÉí·ÝÑéÖ¤µÄ¹ÜÀíÔ±Óû§¿ÉÀûÓøÃ©¶´Ô¶³ÌÖ´ÐÐÃüÁî¡£
¶þ¡¢Ó°Ï췶Χ
QTS 5.1.x < QTS 5.1.3.2578 build 20231110
QuTS hero h5.1.x < QuTS hero h5.1.3.2578 build 20231110
Èý¡¢Äþ¾²´ëÊ©
3.1 Éý¼¶°æ±¾
ĿǰÕâЩ©¶´ÒѾÐÞ¸´£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔϰ汾£º
QTS 5.1.x >= QTS 5.1.3.2578 build 20231110
QuTS hero h5.1.x >= QuTS hero h5.1.3.2578 build 20231110
ÏÂÔØÁ´½Ó£º
https://www.qnap.com/en/download
×¢£º¸üÐÂQTS »òQuTS hero²½ÖèÈçÏ£º
1.ÒÔ¹ÜÀíÔ±Éí·ÝµÇ¼ QTS »ò QuTS hero£»
2.תµ½¡¾¿ØÖÆÃæ°å¡¿>¡¾ÏµÍ³¡¿>¡¾¹Ì¼þ¸üС¿£»
3.ÔÚ¡¾ÊµÊ±¸üС¿Ï£¬µ¥»÷¡¾¼ì²é¸üС¿£»
ϵͳÏÂÔØ²¢°²×°×îеĿÉÓøüС£
3.2 ÁÙʱ´ëÊ©
ÔÝÎÞ¡£
3.3 ͨÓý¨Òé
l ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬¼õÉÙϵͳ©¶´£¬ÌáÉý·þÎñÆ÷µÄÄþ¾²ÐÔ¡£
l ¼ÓǿϵͳºÍÍøÂçµÄ·ÃÎÊ¿ØÖÆ£¬Ð޸ķÀ»ðǽ¼ÆÄ±£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬¼õÉÙ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬¼õÉÙ¹¥»÷Ãæ¡£
l ʹÓÃÆóÒµ¼¶Äþ¾²²úÎÌáÉýÆóÒµµÄÍøÂçÄþ¾²ÐÔÄÜ¡£
l ¼ÓǿϵͳÓû§ºÍȨÏÞ¹ÜÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬Óû§ºÍÈí¼þȨÏÞÓ¦±£³ÖÔÚ×îµÍÏÞ¶È¡£
l ÆôÓÃÇ¿ÃÜÂë¼ÆÄ±²¢ÉèÖÃΪ¶¨ÆÚÐ޸ġ£
3.4 ²Î¿¼Á´½Ó
https://www.qnap.com/en/security-advisory/qsa-23-64
https://www.qnap.com/en/security-advisory/qsa-23-54
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-01-09 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¶«Éƽ̨¼ò½é
¶«Éƽ̨½¨Á¢ÓÚ1996Ä꣬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ´´½¨µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Äþ¾²¸ß¿Æ¼¼ÆóÒµ¡£ÊǹúÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Äþ¾²²úÎï¡¢Äþ¾²·þÎñ½â¾ö·½°¸µÄÁ캽ÆóÒµÖ®Ò»¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¶«Éƽ̨´óÏ㬹«Ë¾Ô±¹¤6000ÓàÈË£¬Ñз¢ÍŶÓ1200ÓàÈË, ¼¼Êõ·þÎñÍŶÓ1300ÓàÈË¡£ÔÚÈ«¹ú¸÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬ÓµÓÐÁýÕÖÈ«¹úµÄÏúÊÛÌåϵ¡¢ÇþµÀÌåϵºÍ¼¼ÊõÖ§³ÖÌåϵ¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬¶«Éƽ̨ÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´ÐµÄÄþ¾²²úÎïºÍ×î¼Ñʵ¼ù·þÎñ£¬×ÊÖú¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄÄþ¾²ÐÔºÍÉú²úЧÄÜ£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Äþ¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Å¬Á¦¡£
5.2 ¹ØÓÚ¶«Éƽ̨
¶«Éƽ̨Äþ¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸ö©¶´Í¨¸æºÍ·çÏÕÔ¤¾¯£¬ÎÒÃǽ«Á¬Ðø¸ú×ÙÈ«Çò×îеÄÍøÂçÄþ¾²Ê¼þºÍ©¶´£¬ÎªÆóÒµµÄÐÅÏ¢Äþ¾²±£¼Ý»¤º½¡£
¹Ø×¢ÎÒÃÇ£º