Secunia

A security issue has been reported in multiple QNAP devices, which can be exploited by malicious, local users to bypass certain security restrictions.

The security issue is caused due to the usage of an insecurely stored backup key when encrypting a hard disk. This can be exploited to decrypt the hard disk by using the key stored in flash memory.

The security issue is reported in TS-239 Pro and TS-639 Pro firmware versions 3.1.1 0815, 3.1.0 0627, and 2.1.7 0613. Other products and versions may also be affected.

Solution
Do not rely on the hard disk encryption feature if access to the flash memory is available.

Provided and/or discovered by
Baseline Security Consulting

Changelog
Further details available in Customer Area

Original Advisory
http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt

Deep Links
Links available in Customer Area