CVE-2013-6955: Critical severity Synology Diskstation Manager vulnerability
webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Synology DiskStation Manager (DSM)to a version that resolves this vulnerability.Fixed in 4.0-2259 - Upgrade
Upgrade
Synology DiskStation Manager (DSM)to a version that resolves this vulnerability.Fixed in 4.2-3243 - Upgrade
Upgrade
Synology DiskStation Manager (DSM)to a version that resolves this vulnerability.Fixed in 4.3-3810 Update 1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6955?
CVE-2013-6955 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2013-6955?
To fix CVE-2013-6955, update your Synology DiskStation Manager to version 4.0-2259 or later, 4.2-3243 or later, or 4.3-3810 Update 1 or later.
What versions of Synology DiskStation Manager are affected by CVE-2013-6955?
CVE-2013-6955 affects Synology DiskStation Manager versions 4.0, 4.2, and 4.3 before their respective updates.
What type of attack can exploit CVE-2013-6955?
CVE-2013-6955 can be exploited through a remote attack that allows for arbitrary file modifications and code execution.
Is there any workaround for CVE-2013-6955 if an update cannot be applied immediately?
There are no documented workarounds for CVE-2013-6955, so immediate update is the best solution.