CVE-2018-14749 - OpenCVE

Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Qnap	Qts

Configuration 1 [-]

OR	cpe:2.3:o:qnap:qts:4.2.6:::::::*
	cpe:2.3:o:qnap:qts:4.3.3:::::::*
	cpe:2.3:o:qnap:qts:4.3.4:::::::*
	cpe:2.3:o:qnap:qts:4.3.5:::::::*

References

Link	Resource
https://www.qnap.com/zh-tw/security-advisory/nas-201811-22	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: qnap

Published: 2018-11-28T16:00:00

Updated: 2018-11-28T15:57:01

Reserved: 2018-07-30T00:00:00

Link: CVE-2018-14749

JSON object: View

NVD Information

Status : Analyzed

Published: 2018-11-28T16:29:00.390

Modified: 2018-12-27T17:25:31.400

Link: CVE-2018-14749

JSON object: View

Redhat Information

No data.

CWE

CWE-119

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "1D9E6F8F-A433-45A7-8839-5D478FE179A4", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "C5994C07-17FE-4784-9FA4-9675BA8B4743", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "F0C7D2D4-769F-4297-89F4-75366FFA7618", "vulnerable": true}, {"criteria": "cpe:2.3:o:qnap:qts:4.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "2C7CF3D8-0BB6-410F-84C1-D48764687561", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer en QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829 y QTS 4.2.6 build 20180829 y sus versiones anteriores podr\u00eda provocar un impacto no especificado en el NAS."}], "id": "CVE-2018-14749", "lastModified": "2018-12-27T17:25:31.400", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-11-28T16:29:00.390", "references": [{"source": "security@qnapsecurity.com.tw", "tags": ["Vendor Advisory"], "url": "https://www.qnap.com/zh-tw/security-advisory/nas-201811-22"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}