Resolved Security Advisory for Command Injection in Music Station
- Release date: October 5, 2017
- Security ID: NAS-201710-05
- Severity: High
- CVE identifier: CVE-2017-13069
- Affected products: Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier
- Status: Resolved
Summary
Security researcher Yoni Ramon discovered a number of command injection vulnerabilities found in Music Station. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS. QNAP acknowledges Mr. Ramon’s discovery and appreciates his efforts.
QNAP has already patched these vulnerabilities in Music Station versions 4.8.7 and 5.0.8.
Recommendations
To resolve the issue, you must update your Music Station to the latest version:
- For QTS 4.2.x: Music Station 4.8.7
- For QTS 4.3.x: Music Station 5.0.8
Upgrading to Music Station 4.8.7 or 5.0.8
- Log on to QTS as administrator.
- Open the App Center, and then click the Search icon.
A search box appears. - Type “Music Station”, and then press ENTER.
The Music Station application appears in the search results list. - Click Update.
A confirmation message appears. - Click OK.
The application is updated.
Revision History: 2017-10-05