Synology DiskStation Manager Observable Discrepancy (CVE-2017-5753)

medium Tenable OT Security Plugin ID 502454

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Refer to the vendor advisory.

See Also

http://www.nessus.org/u?6b559eed

http://www.nessus.org/u?de58c590

http://www.nessus.org/u?851713fe

http://www.nessus.org/u?cd8ae14e

http://www.nessus.org/u?28c4c0a0

http://nvidia.custhelp.com/app/answers/detail/a_id/4609

http://nvidia.custhelp.com/app/answers/detail/a_id/4611

http://nvidia.custhelp.com/app/answers/detail/a_id/4613

http://nvidia.custhelp.com/app/answers/detail/a_id/4614

http://www.nessus.org/u?a875b3c1

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txt

http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txt

http://www.kb.cert.org/vuls/id/584653

http://www.nessus.org/u?76507bf8

http://www.securityfocus.com/bid/102371

http://www.securitytracker.com/id/1040071

http://xenbits.xen.org/xsa/advisory-254.html

https://access.redhat.com/errata/RHSA-2018:0292

http://www.nessus.org/u?892ef523

https://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/

http://www.nessus.org/u?1eae8cc9

https://cdrdv2.intel.com/v1/dl/getContent/685359

https://cert-portal.siemens.com/productcert/pdf/ssa-505225.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdf

https://cert.vde.com/en-us/advisories/vde-2018-002

https://cert.vde.com/en-us/advisories/vde-2018-003

http://www.nessus.org/u?c89c164f

http://www.nessus.org/u?f6e3da0d

http://www.nessus.org/u?2dc887f0

https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html

https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html

https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html

https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html

http://www.nessus.org/u?573cb1ef

https://seclists.org/bugtraq/2019/Jun/36

https://security.gentoo.org/glsa/201810-06

http://www.nessus.org/u?7c4ad7b8

https://security.netapp.com/advisory/ntap-20180104-0001/

https://spectreattack.com/

https://support.citrix.com/article/CTX231399

https://support.f5.com/csp/article/K91229003

http://www.nessus.org/u?576ccd7b

http://www.nessus.org/u?2ec2d10c

https://support.lenovo.com/us/en/solutions/LEN-18282

http://www.nessus.org/u?1bb35f47

https://usn.ubuntu.com/3540-1/

https://usn.ubuntu.com/3540-2/

https://usn.ubuntu.com/3541-1/

https://usn.ubuntu.com/3541-2/

https://usn.ubuntu.com/3542-1/

https://usn.ubuntu.com/3542-2/

https://usn.ubuntu.com/3549-1/

https://usn.ubuntu.com/3580-1/

https://usn.ubuntu.com/3597-1/

https://usn.ubuntu.com/3597-2/

https://usn.ubuntu.com/usn/usn-3516-1/

https://www.debian.org/security/2018/dsa-4187

https://www.debian.org/security/2018/dsa-4188

https://www.exploit-db.com/exploits/43427/

https://www.kb.cert.org/vuls/id/180049

http://www.nessus.org/u?13a2a434

http://www.nessus.org/u?9166970d

http://www.nessus.org/u?f5691f33

https://www.synology.com/support/security/Synology_SA_18_01

https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html

Plugin Details

Severity: Medium

ID: 502454

Version: 1.2

Type: remote

Family: Tenable.ot

Published: 10/1/2024

Updated: 10/2/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2017-5753

CVSS v3

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 5.4

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:synology:diskstation_manager

Required KB Items: Tenable.ot/Synology

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/4/2018

Vulnerability Publication Date: 1/4/2018

Exploitable With

CANVAS (CANVAS)

Reference Information

CVE: CVE-2017-5753

CWE: 203