This security advisory addresses the following NETGEAR PSV numbers: PSV-2017-2206 and PSV-2017-2207.
NETGEAR is aware of a security vulnerability in Samba version 3.5.0 and later, reported on CVE-2017-7494, that can allow an attacker with write access to execute code remotely. Samba is open source software that enables file and print sharing using the SMB file-sharing protocol.
This vulnerability potentially affects the following products because they use Samba version 3.5.0 or later:
- All ReadyNAS products, including the following operating systems:
- 4.1
- 4.2
- 5.x
- 6.x
- All ReadyDATA products
- Routers and gateways:
- C3000
- C3700
- C6220
- C6250
- C6300
- C7000
- C7100V
- N450/CG3000Dv2
- R6400, running firmware versions prior to 1.1.0.26R6900P
- R7000P
- R7900P
- R8000P
Firmware fixes are currently available for some affected products:
- All ReadyNAS products running operating systems 4.1, 4.2, 5.x, and 6.x
- All ReadyDATA products
- R6400
- R6900P
- R7000P
- R7900P
- R8000P
NETGEAR strongly recommends that all affected users download the firmware update that fixes the remote code execution vulnerability for their product as soon as it is available.
You can perform an automatic firmware update for many ReadyNAS models by logging in to your ReadyNAS system, waiting for the pop-up notification that new firmware is available, and confirming that you want to upgrade. You can also perform a manual update using the steps below.
To update your ReadyNAS OS 6.x storage system:
Follow the instructions in this knowledge base article: ReadyNAS OS 6: Updating Firmware.
To update your ReadyDATA storage system:
Follow the instructions in one of these knowledge base articles:
- How do I locally update the firmware on my ReadyDATA storage system?
- How do I remotely update the firmware on my ReadyDATA storage system?
To update your ReadyNAS storage system running RAIDiator 4.2 or 5.x:
- Visit NETGEAR Support.
- Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.
If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for your product model. - Click Documentation.
- Click your product’s software manual.
- Download and install the new firmware according to the instructions in your product’s software manual.
Firmware downloads are available on your product’s support page under Firmware and Software Downloads.
To update your RAIDiator 4.1 storage system:
- Log in to your RAIDiator 4.1 storage system.
- From the FrontView main menu, select System > Update > Remote.
- Click Check for Update.
- Click Perform System Update and click OK.
- After the updated firmware downloads, confirm that you want to reboot your storage system.
- Wait for your storage system to finish rebooting.
Your firmware is updated.
To update your router:
- Visit NETGEAR Support.
- Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.
If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for your product model. - Click Downloads.
- Under Current Versions, select the download whose title begins with Firmware Version.
- Click Release Notes and follow the instructions in the firmware release notes to download and install the new firmware.
Until a firmware fix is available for your product, NETGEAR recommends that you take the one of the following steps:
- Disable write access to drives shared using the SMB file-sharing protocol to anyone who is not a trusted user. For instructions, see How do I change read and write access for a USB drive connected to my router or gateway?.
- Remove any USB storage devices connected to your router or gateway. This is the only workaround option for the N450/CG3000Dv2.
The potential for remote code execution remains if you do not complete all recommended steps. NETGEAR is not responsible for any consequences that could have been avoided by following the recommendations in this notification.
NETGEAR is continuing to investigate and will update this security advisory when more information is available.
We appreciate and value having security concerns brought to our attention. NETGEAR constantly monitors for both known and unknown threats. Being pro-active rather than re-active to emerging security issues is fundamental for product support at NETGEAR.
It is NETGEAR's mission to be the innovative leader in connecting the world to the internet. To achieve this mission, we strive to earn and maintain the trust of those that use NETGEAR products for their connectivity.
To report a security vulnerability, visit https://bugcrowd.com/netgear.
If you are a NETGEAR customer with a security-related support concern, you can contact NETGEAR customer support at techsupport.security@netgear.com.
For all other issues, visit http://www.netgear.com/about/security/.