Western Digital customers urged to update to latest version of My Cloud OS

Date:
Fri, 25 Mar 2022 12:30:55 +0000

Description:
WD has delivered a fix for a serious vulnerability uncovered during a hacking contest.

FULL STORY ======================================================================

Western Digital has pushed a new firmware update for its My Cloud OS, fixing
a high- severity vulnerability that was discovered during a recent hacking contest.

As reported by BleepingComputer , cybersecurity experts from the NCC Group exploited a flaw in Netatalk Service, an open-source implementation of the Apple Filing Protocol (AFP) that allows for Unix-like operating systems to serve as file servers for macOS clients.

The flaw, now tracked as CVE-2022-23121, carries a severity score of 9.8/10, as it allows threat actors to run any code on the target endpoint , without authentication. TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a 100 Amazon gift card (or equivalent in USD). Thank you for taking part.

Click here to start the survey in a new window << Removing Netatalk

The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries, the Zero Day Initiative advisory reads. An attacker can leverage this vulnerability to execute code in the context of root.

As a result, Western Digital pulled the Netatalk service completely from the My Cloud OS, starting with firmware version 5.19.117, and has advised all WD NAS users to update their endpoints to this version.

These are the devices considered vulnerable to the exploit: My Cloud PR2100
My Cloud PR4100 My Cloud EX2 Ultra My Cloud EX 4100 My Cloud Mirror Gen 2 My Cloud EX2100 My Cloud DL2100 My Cloud DL4100 Read more

Western Digital desktop app exposes Windows and macOS users to attack

WD My Cloud NAS boxes can be hacked over the internet, claim researchers

Western Digital admits it throttled write speeds with flash memory change

WD NAS users who decide to update their devices to the latest version can no longer use the Netatalk service, but can continue accessing network shares
via SMB.

The Netatalk development team didnt sit idly, however. After the remote code execution bug was exploited in the contest, they pushed an update fixing CVE-2022-23121 and a number of other known vulnerabilities, some of which was classified as critical. These are the best cloud storage right now

Via BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/western-digital-my-cloud-os-update-plugs-a-nast y-security-hole/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)