CVE-2017-9552
HighSummary
A design flaw in authentication in Synology Photo Station versions 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Users can sniff credentials using the command 'synophoto_dsm_user --auth USERNAME PASSWORD'.
Risk Assessment
Local users can gain access to the login credentials of other users, posing a risk of unauthorized access to accounts and data within the system.
Recommendation
It is recommended to update Synology Photo Station to the latest version to mitigate this vulnerability and to restrict system access for unauthorized users.
Other vulnerabilities in Synology Photo Station
See all- CVE-2017-12079High
A vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to access arbitrary files or directories.
- CVE-2017-11155High
The CVE-2017-11155 vulnerability in index.php in Synology Photo Station before version 6.7.3-3432 and 6.3-2967 allows remote attackers to access sensitive system information via unspecified vectors.
- CVE-2017-11154High
CVE-2017-11154 describes an unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before version 6.7.3-3432 and 6.3-2967, allowing remote attackers to create arbitrary PHP scripts via the type parameter.
- CVE-2017-11152High
CVE-2017-11152 describes a vulnerability in PixlrEditorHandler.php in Synology Photo Station before version 6.7.3-3432 and 6.3-2967, allowing remote attackers to write arbitrary files via the path parameter.
- CVE-2016-10331High
CVE-2016-10331 is a vulnerability in download.php in Synology Photo Station before version 6.5.3-3226 that allows remote attackers to read arbitrary files via a full pathname in the id parameter.
- CVE-2016-10323High
Synology Photo Station before version 6.3-2958 allows local users to gain privileges by leveraging setuid execution of the 'synophoto_dsm_user --copy-no-ea' command.
- CVE-2016-10322High
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.
- CVE-2017-11161Critical
Multiple SQL injection vulnerabilities in Synology Photo Station before version 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
- CVE-2017-11153Critical
A deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before version 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
- CVE-2017-11151Critical
A vulnerability in synotheme_upload.php in Synology Photo Station before version 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.
Original NVD description (English source)
A design flaw in authentication in Synology Photo Station 6.0-2528 through 6.7.1-3419 allows local users to obtain credentials via cmdline. Synology Photo Station employs the synophoto_dsm_user program to authenticate username and password by "synophoto_dsm_user --auth USERNAME PASSWORD", and local users are able to obtain credentials by sniffing "/proc/*/cmdline".