CVE-2017-9552
Summary
| CVE | CVE-2017-9552 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-06-13 13:29:00 UTC |
| Updated | 2019-10-09 23:30:00 UTC |
| Description | A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline". |
Risk And Classification
Problem Types: CWE-287
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Synology | Photo Station | 6.0-2528 | All | All | All |
| Application | Synology | Photo Station | 6.0-2636 | All | All | All |
| Application | Synology | Photo Station | 6.0-2638 | All | All | All |
| Application | Synology | Photo Station | 6.0-2639 | All | All | All |
| Application | Synology | Photo Station | 6.0-2640 | All | All | All |
| Application | Synology | Photo Station | 6.3-2944 | All | All | All |
| Application | Synology | Photo Station | 6.3-2958 | All | All | All |
| Application | Synology | Photo Station | 6.3-2960 | All | All | All |
| Application | Synology | Photo Station | 6.3-2962 | All | All | All |
| Application | Synology | Photo Station | 6.3-2963 | All | All | All |
| Application | Synology | Photo Station | 6.3-2964 | All | All | All |
| Application | Synology | Photo Station | 6.3-2965 | All | All | All |
| Application | Synology | Photo Station | 6.4-3166 | All | All | All |
| Application | Synology | Photo Station | 6.5.0-3218 | All | All | All |
| Application | Synology | Photo Station | 6.5.1-3223 | All | All | All |
| Application | Synology | Photo Station | 6.5.2-3225 | All | All | All |
| Application | Synology | Photo Station | 6.5.3-3226 | All | All | All |
| Application | Synology | Photo Station | 6.6.0-3339 | All | All | All |
| Application | Synology | Photo Station | 6.6.1-3345 | All | All | All |
| Application | Synology | Photo Station | 6.6.1-3346 | All | All | All |
| Application | Synology | Photo Station | 6.6.2-3346 | All | All | All |
| Application | Synology | Photo Station | 6.6.3-3347 | All | All | All |
| Application | Synology | Photo Station | 6.7.0-3414 | All | All | All |
| Application | Synology | Photo Station | 6.7.1-3419 | All | All | All |
| Application | Synology | Photo Station | 6.0-2528 | All | All | All |
| Application | Synology | Photo Station | 6.0-2636 | All | All | All |
| Application | Synology | Photo Station | 6.0-2638 | All | All | All |
| Application | Synology | Photo Station | 6.0-2639 | All | All | All |
| Application | Synology | Photo Station | 6.0-2640 | All | All | All |
| Application | Synology | Photo Station | 6.3-2944 | All | All | All |
| Application | Synology | Photo Station | 6.3-2958 | All | All | All |
| Application | Synology | Photo Station | 6.3-2960 | All | All | All |
| Application | Synology | Photo Station | 6.3-2962 | All | All | All |
| Application | Synology | Photo Station | 6.3-2963 | All | All | All |
| Application | Synology | Photo Station | 6.3-2964 | All | All | All |
| Application | Synology | Photo Station | 6.3-2965 | All | All | All |
| Application | Synology | Photo Station | 6.4-3166 | All | All | All |
| Application | Synology | Photo Station | 6.5.0-3218 | All | All | All |
| Application | Synology | Photo Station | 6.5.1-3223 | All | All | All |
| Application | Synology | Photo Station | 6.5.2-3225 | All | All | All |
| Application | Synology | Photo Station | 6.5.3-3226 | All | All | All |
| Application | Synology | Photo Station | 6.6.0-3339 | All | All | All |
| Application | Synology | Photo Station | 6.6.1-3345 | All | All | All |
| Application | Synology | Photo Station | 6.6.1-3346 | All | All | All |
| Application | Synology | Photo Station | 6.6.2-3346 | All | All | All |
| Application | Synology | Photo Station | 6.6.3-3347 | All | All | All |
| Application | Synology | Photo Station | 6.7.0-3414 | All | All | All |
| Application | Synology | Photo Station | 6.7.1-3419 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory | Synology Inc. | CONFIRM | www.synology.com | Third Party Advisory |
| Frederic Crozat blog: Synology PhotoStation password vulnerability | MISC | blog.crozat.net | Issue Tracking, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.