JVNDB-2014-000126

Vulnerability from jvndb - Published: 2014-10-28 05:39 - Updated:2015-12-25 04:47
Severity
N/A (UNKNOWN) - -
Summary
QNAP QTS vulnerable to OS command injection
Details
QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a flaw in the GNU Bash shell, which may result in an OS command injection vulnerability (CWE-78). Yuuki Wakisaka of University of Electro-Communications reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN http://jvn.jp/en/jp/JVN55667175/index.html
JVN https://jvn.jp/vu/JVNVU97219505/index.html
JVN http://jvn.jp/vu/JVNVU97220341/index.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004399.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004410.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004431.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004476.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004432.html
JVN iPedia http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004433.html
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169
CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186
CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6277
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6278
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7186
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7187
CERT-VN http://www.kb.cert.org/vuls/id/252743
ICS-CERT ADVISORY https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01
ICS-CERT ADVISORY https://www.cisa.gov/news-events/ics-advisories/icsa-14-269-01a
OS Command Injection(CWE-78) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000126.html",
  "dc:date": "2015-12-25T13:47+09:00",
  "dcterms:issued": "2014-10-28T14:39+09:00",
  "dcterms:modified": "2015-12-25T13:47+09:00",
  "description": "QNAP QTS is an operating system for Turbo NAS. QNAP QTS contains a flaw in the GNU Bash shell, which may result in an OS command injection vulnerability (CWE-78).\r\n\r\nYuuki Wakisaka of University of Electro-Communications reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000126.html",
  "sec:cpe": {
    "#text": "cpe:/o:qnap:qts",
    "@product": "QNAP QTS",
    "@vendor": "QNAP Systems",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "10.0",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000126",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN55667175/index.html",
      "@id": "JVN#55667175",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/vu/JVNVU97219505/index.html",
      "@id": "JVNVU#97219505",
      "@source": "JVN"
    },
    {
      "#text": "http://jvn.jp/vu/JVNVU97220341/index.html",
      "@id": "JVNVU#97220341",
      "@source": "JVN"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004399.html",
      "@id": "JVNDB-2014-004399",
      "@source": "JVN iPedia"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004410.html",
      "@id": "JVNDB-2014-004410",
      "@source": "JVN iPedia"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004431.html",
      "@id": "JVNDB-2014-004431",
      "@source": "JVN iPedia"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004476.html",
      "@id": "JVNDB-2014-004476",
      "@source": "JVN iPedia"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004432.html",
      "@id": "JVNDB-2014-004432",
      "@source": "JVN iPedia"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004433.html",
      "@id": "JVNDB-2014-004433",
      "@source": "JVN iPedia"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169",
      "@id": "CVE-2014-7169",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271",
      "@id": "CVE-2014-6271",
      "@source": "CVE"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277",
      "@id": "CVE-2014-6277",
      "@source": "CVE"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278",
      "@id": "CVE-2014-6278",
      "@source": "CVE"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186",
      "@id": "CVE-2014-7186",
      "@source": "CVE"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187",
      "@id": "CVE-2014-7187",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169",
      "@id": "CVE-2014-7169",
      "@source": "NVD"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271",
      "@id": "CVE-2014-6271",
      "@source": "NVD"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6277",
      "@id": "CVE-2014-6277",
      "@source": "NVD"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6278",
      "@id": "CVE-2014-6278",
      "@source": "NVD"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7186",
      "@id": "CVE-2014-7186",
      "@source": "NVD"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7187",
      "@id": "CVE-2014-7187",
      "@source": "NVD"
    },
    {
      "#text": "http://www.kb.cert.org/vuls/id/252743",
      "@id": "VU#252743",
      "@source": "CERT-VN"
    },
    {
      "#text": "https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01",
      "@id": "ICSA-15-344-01",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-269-01a",
      "@id": "ICSA-14-269-01A",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "QNAP QTS vulnerable to OS command injection"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.