====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN321
_____________________________________________________________________

DATE                : 09/06/2020

HARDWARE PLATFORM(S): QNAP NAS devices running Photo Station.

OPERATING SYSTEM(S): Systems running QTS versions prior to 4.4.1 build
                              20190918, 4.3.6 build 20190919,
           Photo Station versions prior to 6.0.3, 5.7.10, 5.4.9, 5.2.11.

=====================================================================
https://www.qnap.com/fr-fr/security-advisory/qsa-20-02
_____________________________________________________________________

eCh0raix Ransomware

    Release date: June 8, 2020
    Security ID: QSA-20-02
    Severity: High
    CVE identifier: N/A
    Affected products: QNAP NAS devices running Photo Station


Summary

The eCh0raix ransomware (MR1904) has been reported to target QNAP NAS
devices and exploit certain vulnerabilities in earlier versions of QTS
and Photo Station.


We have already fixed these issues in recent releases since September 2019.


QTS:

    QTS 4.4.1: build 20190918 and later
    QTS 4.3.6: build 20190919 and later

Photo Station:

    QTS 4.4.1: Photo Station 6.0.3 and later
    QTS 4.3.4 - QTS 4.4.0: Photo Station 5.7.10 and later
    QTS 4.3.0 - QTS 4.3.3: Photo Station 5.4.9 and later
    QTS 4.2.6: Photo Station 5.2.11 and later


Recommendation

To secure your device and to protect your data from ransomware attacks
and unauthorized usage, we strongly recommend updating QTS and Photo
Station to their latest versions.


Important:

Regardless of your current QTS version, QNAP strongly recommends
updating your QTS to the latest available version for your NAS model to
ensure that your device can benefit from vulnerability fixes. You can
check the product support status of your NAS model.


Installing the QTS Update

    Log on to QTS as administrator.
    Go to Control Panel > System > Firmware Update.
    Under Live Update, click Check for Update.

QTS downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to
Support > Download Center and then perform a manual update for your
specific device.


Updating Photo Station

    Log on to QTS as administrator.
    Open the App Center, and then click .
    A search box appears.
    Type “Photo Station”, and then press ENTER.
    The Photo Station application appears in the search result list.
    Click Update.
    A confirmation message appears.
    Note: The Update button is not available if you are using the latest
     version.
    Click OK.
    The application is updated.

Revision History: V1.0 (June 8, 2020) - Published


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================