Vulnerabilities in Samba

Summary

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba, including vulnerabilities related to RC4 encryption. If exploited, some of these vulnerabilities allow an attacker to take control of an affected system. 

Only QNAP devices that run the affected operating systems and also act as a domain controller or AD member are affected.

Standalone QNAP devices are not affected by the vulnerabilities.

We have already fixed the vulnerabilities in the following versions:

Recommendation

To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes. You can check the product support status to see the latest updates available to your NAS model.

Updating QTS, QuTS hero, or QuTScloud

1. Log in to QTS, QuTS hero, or QuTScloud as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Recommendation for Users Who Decide Not to Update

If at this time you decide not to update your QNAP operating system to a fixed version, we strongly recommend replacing RC4 with the more secure AES algorithm when using your QNAP device as a domain controller or AD member:

• When the QNAP device acts as a domain controller, we strongly recommend enforcing AES encryption.
• When the QNAP device acts as an AD member, the encryption method should follow that of the domain controller. We also strongly recommend that the domain controller is configured to enforce AES encryption.

Depending on the AD domain role of your QNAP device, we recommend enforcing AES encryption only or at least allowing both AES and RC4 encryption to mitigate the risks posed by the vulnerabilities.

Checking the Current Encryption Enforcement Status

1. SSH into your QNAP operating system.
2. Enter the following command:
   sudo testparm -sv  2>/dev/null | grep "reject md5 servers"

Enforcing AES Encryption Only

1. SSH into your QNAP operating system.
2. Enter the following commands:
   sudo setcfg global 'reject md5 servers' yes -f /etc/config/smb.conf
   sudo /etc/init.d/smb.sh restart

Allowing Both AES and RC4 Encryption

1. SSH into your QNAP operating system.
2. Enter the following commands:
   sudo setcfg global 'reject md5 servers' no -f /etc/config/smb.conf
   sudo /etc/init.d/smb.sh restart