CVE-2021-3156 - Heap-Based Buffer Overflow in Sudo (Baron Samedit)
Last modified date:
2021-02-04
- Release date: January 28, 2021
- Security ID: QSA-21-02
- Severity: Medium
- CVE identifier: CVE-2021-3156
- Affected products: All QNAP NAS
- Status: Investigating
Summary
The Qualys research team has reported a heap-based buffer overflow vulnerability in sudo, an important utility for Unix-like and Linux-based operating systems, including QTS, QuTS hero, and QES from QNAP.
If exploited, this vulnerability allows any unprivileged users to gain escalated root privileges on the vulnerable host.
QNAP is thoroughly investigating the case. We will release security updates and provide further information as soon as possible.
Recommendation
To secure your device, we recommend disabling SSH and Telnet whenever you are not using these services.
Disabling SSH and Telnet Connections in QTS or QuTS hero
- Log on to QTS or QuTS hero as administrator.
- Go to Control Panel > Network & File Services > Telnet/SSH.
- Deselect Allow Telnet connection.
- Deselect Allow SSH connection.
- Click Apply.
Disabling SSH Connections in QES
- Log on to QES as administrator.
- Go to Control Panel > Network & File Services > SSH.
- Deselect Allow SSH connection.
- Click Apply.
Revision History: V1.0 (January 28, 2021) - Published
