R7300 DST, QOS, Automatically update performance optimization database fails

@strubinksy I sent you a PM on the 19th. See your inbox too. 

Elaine - So does your firmware you provided us also contain the fix for security advisory VU 582384? If not when will your fix be back propt into the a firmware package that also contains this? I have already delt with one customer that has possibly be exposed to the code injection issue.

It allegedly does also mitigate the vulnerability in question. But it is beta, which is why we don't get them as easy as we wish since there might be side effects.

I won't be able to test and document the outcome soon since I am in the process of replacing mine. It developed erratic behavior after 11 (!!!) months use and it's a pain to get an in-warranty replacement.

Others have also received the firmware replacement and will be able to verify that or if both issues are fixed and if there is a side effect.

Testing is easy and documented:

http://www.computerworld.com/article/3148680/networking/easily-exploited-netgear-router-flaw-discovered.html

Read following:

"UPDATE: December 10, 2016 11PM ET. "

Here the POC:

https://www.youtube.com/watch?v=kOZs90BGPFk&feature=youtu.be

---

strubinsky wrote:

But it is beta, which is why we don't get them as easy as we wish since there might be side effects.

  

---

Netgear clearly wants to get the patches out there ASAP, and I'm told that releasing security patches as beta is the quickest path.

The definition of 'Beta' software is that it has not been fully tested and is not guaranteed to be as error free as we consumers can and do expect. Beta is not ready for prime time yet or it would be called 'Production'.

There might be the case that a few 'crappy old' errors are replaced by 'shiny new' ones but after the regression test/fix cycle succeeded it goes prod. You don't give beta to an end-user because they don't care what it is: If it fails somewhere they start yelling 'bah humbug' and flock to their facebook. We are those who are aware of the potential that we might experience minor up to major side effects aka. it is NOT yet the final version and we will replace our betas to prd after it was released.

That is at least my humble opinion and I am sticking to it.

---

strubinsky wrote:

 

That is at least my humble opinion and I am sticking to it.

---

It's certainly aligned with my understanding of "beta" too.  

But it is not unusual for Netgear to initially release security fixes as "beta".  There have been several ReadyNAS patches released that way over the years, and some didn't reach production for many months.  

Again, my understanding here is that making them "beta" allows Netgear internal processes to be bypassed, getting the fixes into the field more quickly.  It can get in the way for some business customers, who often have policies that don't allow deployment of beta software.

FWIW, I suspect full regression testing of the patches is probably one of things being skipped.  Though usually these fixes are very targeted, so side effects aren't that likely.

DrXtreme The firmware you received does not contain the security vulnerability fix. The latest firmware released on this site fixes that. 

That is what I was afraid of ... That one fixes the security issue but breaks android connectivity (*android Kit Kat and newer) craaaawwwwwwwwllllls! ) and so even if I couldn't update QoS database I cannot use it as the droid based hardware is usless to all when its using 1.46.xxxx

Will you experience problem when you stay on the 1.0.0.45 fw?

Hello all,  

   I am having the same issue updaing the QoS database.  Is there a fix for this yet?  

sand1 Kindly check your inbox. 

I am having the same issue. Current firmware V1.0.0.46_1.0.13, current QOS DB v1.46,1.0.26.

bluxnj Kindly check your inbox too. 

Having the same issues.

Sorry forgot info. Firmware Version V1.0.0.46_1.0.13   Current Performance Optimization Database on Router Version: v1.46,1.0.26

EarlCalvin Check your inbox. 

I'm having the same issue and I've updated to the latest version of code (Firmware Version
V1.0.0.46_1.0.13). 

JJ-AA-SS Check your inbox too.

I venture to disagree!

I received my replacement, updated to V1.0.0.46_1.0.13

and received:

I'm curious why everyone is being told to check their inbox rather than just posting your response here? I'm having the same issue and would like the resolution! :D I'm running firmware version V1.0.0.46_1.0.13 and QoS database version v1.46,1.0.26. I get the same error when trying to download the Performance Optimization Database, When I click "Update Now" to check for new data it returns "Attempting to connect to Netgear Server. Please Wait..." --

Then it returns:

Clicking on "YES" the router says Attempting to connect to Netgear Server. Please Wait... -- It flashes once (statement goes away - then returns to same "Attempting to connect to Netgear Server. Please Wait...") -- Then it says could not download database and I get the "Database could not be downloaded from the NETGEAR server. Please check your Internet connection." error message

mvelders Because the resolution is in beta which I have sent to your inbox as well. 

Thanks Elaine. When do you suppose a new production firmware update will be released that addresses both the vulnerability and the QoS issue? I'm good for now. Updated to the beta, then QoS database and then back to the latest production firmware. I'm just curious.

I'm having same issue and need the firmware beta to fix the problem so I can update the performance QOS database.  ElanieM can you send to me?