We remove it only as a precaution," a Synology spokesperson told CSO Australia.
The executable is only able to change ownership of system files that belong to Cloud Station client but not others. " was released on May 12 along with the latest version of our OS (DSM 5.2). Synology played down the threat posed to Mac users with the affected client installed. To achieve this purpose, client_chown was able to change the ownership of certain system files that belong to Cloud Station client,” Synology is quoted as saying. The client_chown tool was originally designed to ease the upgrade process of the Cloud Station client, and was included starting from build 2291. "We have removed client_chown in the latest build (3.2-3475) as precaution, even though the impact is concluded to be very low.
Cloud station client for mac update#
It also urged users to update the Cloud Station client for OS X to version 3.2-3475. “This allows any user the ability to change ownership of arbitrary system files, which may be leveraged to gain root privileges and fully compromise the host,” the CERT noted. The flaw poses a risk not just to files for syncing, but the fact the files can be changed could be used to control the host. The problem is that it’s installed as a “setuid root executable”. According to the CERT for Carnegie Mellon University, the Cloud Station client for OS X “ contains an executable named client_chown that allows users to change the ownership of files”.
0 kommentar(er)
