Synology DiskStation Manager 'FileBrowser' Component Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	64483
Class:	Unknown
CVE:	CVE-2013-6987
Remote:	Yes
Local:	No
Published:	Dec 20 2013 12:00AM
Updated:	Dec 20 2013 12:00AM
Credit:	Andrea Fabrizi
Vulnerable:	Synology Diskstation Manager 4.3-3810 Synology Diskstation Manager 4.3
Not Vulnerable:

Synology DiskStation Manager 'FileBrowser' Component Multiple Directory Traversal Vulnerabilities

Synology DiskStation Manager is prone to a multiple directory-traversal vulnerabilities.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to bypass security restrictions and perform unauthorized actions on system and configuration files in the context of the application.

Synology DiskStation Manager 4.3-3810 and prior are vulnerable.

Synology DiskStation Manager 'FileBrowser' Component Multiple Directory Traversal Vulnerabilities

An attacker can exploit this issue using a web browser.

The following example data is available:

• /data/vulnerabilities/exploits/64483.txt

Synology DiskStation Manager 'FileBrowser' Component Multiple Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Synology DiskStation Manager 'FileBrowser' Component Multiple Directory Traversal Vulnerabilities

References:

• Synology DiskStation Manager Homepage (Synology)
  
• Synology DSM multiple directory traversal (Andrea Fabrizi)