CVE-2017-11156
14.08.2017, 19:29
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.Enginsight
| Vendor | Product | Version |
|---|---|---|
| synology | download_station | 3.2-2295 |
| synology | download_station | 3.3-2382 |
| synology | download_station | 3.3-2383 |
| synology | download_station | 3.3-2386 |
| synology | download_station | 3.4-2477 |
| synology | download_station | 3.4-2478 |
| synology | download_station | 3.4-2480 |
| synology | download_station | 3.4-2485 |
| synology | download_station | 3.4-2486 |
| synology | download_station | 3.4-2489 |
| synology | download_station | 3.4-2490 |
| synology | download_station | 3.4-2514 |
| synology | download_station | 3.4-2555 |
| synology | download_station | 3.4-2557 |
| synology | download_station | 3.4-2558 |
| synology | download_station | 3.5-2638 |
| synology | download_station | 3.5-2705 |
| synology | download_station | 3.5-2706 |
| synology | download_station | 3.5-2955 |
| synology | download_station | 3.5-2956 |
| synology | download_station | 3.5-2962 |
| synology | download_station | 3.5-2963 |
| synology | download_station | 3.5-2967 |
| synology | download_station | 3.5-2968 |
| synology | download_station | 3.5-2970 |
| synology | download_station | 3.5-2973 |
| synology | download_station | 3.5-2980 |
| synology | download_station | 3.5-2982 |
| synology | download_station | 3.8.0-3416 |
| synology | download_station | 3.8.1-3420 |
| synology | download_station | 3.8.2-3455 |
| synology | download_station | 3.8.3-3458 |
| synology | download_station | 3.8.4-3468 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-276 - Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
- CWE-732 - Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.