Classic Buffer Overflow Vulnerability Affects Synology Drive Client
CVE-2023-52946

8.2HIGH

Key Information:

Vendor

Synology
Status
Synology Drive Client
Vendor
CVE Published:
26 September 2024

What is CVE-2023-52946?

A buffer copy without proper size validation in the vss service component of Synology Drive Client prior to version 3.5.0-16084 creates an exploitable scenario for remote attackers. This vulnerability can lead to the overwriting of trivial buffers and potentially crash the client through various unspecified vectors. It emphasizes the critical need for implementing size checks during buffer operations to prevent unauthorized access and ensure system stability.

Affected Version(s)

Synology Drive Client *

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhao Runzi (赵润梓)
.