Re: Critical Vulnerability in Ubiquiti UniFi
Carlos Silva <[email protected]> Sat, 1 Oct 2016 14:30:53 +0100
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.web-applications,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CA+ZvHYHWb8CnF0brybCgKWmRyzenCpXbsCvPny=7gc3y056ZcQ@mail.gmail.com> |
SGkgVGltIQoKSSBjYW4gYmUgbWlzc2luZyBzb21ldGhpbmcgaGVyZSBidXQgSSBqdXN0IGNoZWNr ZWQgdGhpcyBvbiBhIGZyZXNoCmluc3RhbGxlZCBVbmlmaSBDb250cm9sbGVyIGFuZCBtb25nb2Qg aXMgYmluZGluZyB0byBsb2NhbGhvc3QgbWFraW5nIHRoaXMgYQpub24taXNzdWUuIE9yLCB5b3Ug aGF2ZSB0byBnZXQgYSByZW1vdGUgc2hlbGwgZmlyc3QgYmVmb3JlIHlvdSBjYW4gZ2V0IGEKY29u bmVjdGlvbiB0byB0aGUgREIuIEFtIEkgbWlzc2luZyBzb21ldGhpbmc/CgpUaGFua3MsCkNhcmxv cyBTaWx2YQoKT24gRnJpLCBTZXAgMzAsIDIwMTYgYXQgMTA6NDkgQU0sIFRpbSBTY2h1Z2hhcnQg PAp0LnNjaHVnaGFydEBwcm9zZWMtbmV0d29ya3MuY29tPiB3cm90ZToKCj4gSGVsbG8gQGFsbCwK Pgo+IHRvZ2V0aGVyIHdpdGggbXkgY29sbGVhZ3VlIHdlIGZvdW5kIHR3byB1bmNyaXRpY2FsIHZ1 bG5lcmFiaWxpdGllcyB5b3UnbGwKPiBmaW5kIGJlbG93Lgo+Cj4gUHJvZHVjdDogVW5pRmkgQVAg QUMgTGl0ZQo+IFZlbmRvcjogVWJpcXVpdGkgTmV0d29ya3MgSW5jLgo+Cj4gSW50ZXJuYWwgcmVm ZXJlbmNlOiA/IChCdWcgSUQpCj4gVnVsbmVyYWJpbGl0eSB0eXBlOiBJbmNvcnJlY3QgYWNjZXNz IGNvbnRyb2wKPiBWdWxuZXJhYmxlIHZlcnNpb246IFVuaWZ5IDUuMi43IGFuZCBwb3NzaWJsZSBv dGhlciB2ZXJzaW9ucyBhZmZlY3RlZCAobm90Cj4gdGVzdGVkKQo+IFZ1bG5lcmFibGUgY29tcG9u ZW50OiBEYXRhYmFzZQo+IFJlcG9ydCBjb25maWRlbmNlOiB5ZXMKPiBTb2x1dGlvbiBzdGF0dXM6 IE5vdCBmaXhlZCBieSBWZW5kb3IsIHRoZSBidWcgaXMgYSBmZWF0dXJlLgo+IEZpeGVkIHZlcnNp b25zOiAtCj4gUmVzZWFyY2hlciBjcmVkaXRzOiBUaW0gU2NodWdoYXJ0LCBJbW1hbnVlbCBCw6Ry LCBLaGFuaCBRdW9jIFBoYW0gb2YgUHJvU2VjCj4gTmV0d29ya3MKPiBTb2x1dGlvbiBkYXRlOiAt Cj4gUHVibGljIGRpc2Nsb3N1cmU6IDIwMTYtMDktMzAKPiBDVkUgcmVmZXJlbmNlOiBDVkUtMjAx Ni03NzkyCj4gQ1ZTU3YzOiA4LjggQVY6QS9BQzpML1BSOk4vVUk6Ti9TOlUvQzpIL0k6SC9BOkgK Pgo+Cj4gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOgo+IFlvdSBhcmUgYWJsZSB0byBjb25uZWN0IHRv IHRoZSBhY2Nlc3MgcG9pbnRzIGRhdGFiYXNlLCBiZWNhdXNlIG9mIGFuCj4gYnJva2VuIGF1dGhl bnRpY2F0aW9uIChPV0FTUCBUT1AxMCkuIFNvIHlvdSBhcmUgYWJsZSB0byBtb2RpZnkgdGhlIGRh dGFiYXNlCj4gYW5kIHJlYWQgdGhlIGRhdGEuIEFuIHBvc3NpYmxlIHNjZW5hcmlvIHlvdSdsbCBm aW5kIGluIFBvQyBzZWN0aW9uLgo+Cj4gUmlzazoKPiBBbiBhdHRhY2tlciBnZXRzIGFjY2VzcyB0 byB0aGUgZGF0YWJhc2UgYW5kIGZvciBlLmcuIGlzIGFibGUgdG8gY2hhbmdlIHRoZQo+IGFkbWlu cyBwYXNzd29yZCwgbGlrZSB5b3Ugc2VlIGluIFBvQyBiZWxvdy4KPgo+IFBvQzoKPiAgMS4gR2Vu ZXJhdGUgU0hBNTEyIEhhc2ggd2l0aCBlLmcuCj4gIG1rcGFzc3dkIC1tIHNoYS01MTIKPgo+ICAy LiBDb25uZWN0IHZpYSBuZXR3b3JrIHRvIGRhdGFiYXNlLCBlLmcuIDoKPiAgbW9uZ28gLS1wb3J0 IDI3MTE3IC0taG9zdCB0YXJnZXRfaXAKPgo+ICAzLiBDaGFuZ2UgcGFzc3dvcmQgdmlhIGNvbW1h bmQKPiAgImRiLmFkbWluLnVwZGF0ZSh7Im5hbWUiOiJQcm9TZWMifSwgeyRzZXQgOiB7Inhfc2hh ZG93IjoKPiAgIiQ2JFNlOWk1STdrM2hJOGQ0YmskQ3FFWFJVd2s3YzdBLzYyRS9IY0M0U3JNU0xP ckJkbTd3UnZ3VFM0dC4KPiBuTkpBM1JZdGEwUmZ6SnB1UkVnLnFjQUhzUEdXOUdqd20za3JKUk9Y emJDdi4ifX0pIgo+ICA0LiBMb2dpbiB2aWEgd2ViIGludGVyZmFjZSB3aXRoIG5ldyBwYXNzd29y ZAo+Cj4KPiBCZXN0IHJlZ2FyZHMgLyBNaXQgZnJldW5kbGljaGVuIEdyw7zDn2VuCj4KPgo+IFRp bSBTY2h1Z2hhcnQKPiBDRU8gLyBHZXNjaMOkZnRzZsO8aHJlcgo+Cj4gLS0KPiBQcm9TZWMgTmV0 d29ya3MgZS5LLgo+IEVsbGluZ3Nob2hsIDgyCj4gNTYwNzcgS29ibGVuego+Cj4gV2Vic2l0ZTog aHR0cHM6Ly93d3cucHJvc2VjLW5ldHdvcmtzLmNvbQo+IEUtTWFpbDogdC5zY2h1Z2hhcnRAcHJv c2VjLm5ldHdvcmtzLmNvbQo+IE1vYmlsZTogKzQ5ICgwKTE1NyA3OTAxIDU4MjYKPiBQaG9uZTog KzQ5ICgwKTI2MSA0NTAgOTMwIDkwCj4KPiAiVGhpcyBFLU1haWwgY29tbXVuaWNhdGlvbiBtYXkg Y29udGFpbiBDT05GSURFTlRJQUwsIFBSSVZJTEVHRUQgYW5kL29yCj4gTEVHQUxMWSBQUk9URUNU RUQgaW5mb3JtYXRpb24gYW5kIGlzIGludGVuZGVkIG9ubHkgZm9yIHRoZSBuYW1lZAo+IHJlY2lw aWVudChzKS4gQW55IHVuYXV0aG9yaXplZCB1c2UsIGRpc3NlbWluYXRpb24sIGNvcHlpbmcgb3Ig Zm9yd2FyZGluZyBpcwo+IHN0cmljdGx5IHByb2hpYml0ZWQuIElmIHlvdSBhcmUgbm90IHRoZSBp bnRlbmRlZCByZWNpcGllbnQgYW5kIGhhdmUKPiByZWNlaXZlZCB0aGlzIGVtYWlsIGNvbW11bmlj YXRpb24gaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlcgo+IGltbWVkaWF0ZWx5LCBk ZWxldGUgaXQgYW5kIGRlc3Ryb3kgYWxsIGNvcGllcyBvZiB0aGlzIEUtTWFpbC4gVkFUIElEOgo+ IERFMjkwNjU0NzE0IGxlZ2FsIGRvbWljaWxlIEtvYmxlbnosIEhSQSAyMTYyNS7igJwKPgo+ICJE aWVzZSBFLU1haWwgTWl0dGVpbHVuZyBrYW5uIFZFUlRSQVVMSUNIRSwgZGVtIEJFUlVGU0dFSEVJ TU5JUwo+IFVOVEVSTElFR0VOREUgdW5kL29kZXIgUkVDSFRMSUNIIEdFU0NIw5xUWlRFIEluZm9y bWF0aW9uZW4gZW50aGFsdGVuIHVuZCBpc3QKPiBhdXNzY2hsaWXDn2xpY2ggZsO8ciBkZW4vZGll IGdlbmFubnRlbiBBZHJlc3NhdGVuIGJlc3RpbW10LiBKZWRlIHVuYmVmdWd0ZQo+IE51dHp1bmcs IFdlaXRlcmdhYmUsIFZlcnZpZWxmw6RsdGlndW5nIG9kZXIgVmVyc2VuZHVuZyBpc3Qgc3RyZW5n c3RlbnMKPiB2ZXJib3Rlbi4gU29sbHRlbiBTaWUgbmljaHQgZGVyIGFuZ2VnZWJlbmUgQWRyZXNz YXQgc2VpbiB1bmQgZGllc2UgRS1NYWlsCj4gTWl0dGVpbHVuZyBpcnJ0w7xtbGljaCBlcmhhbHRl biBoYWJlbiwgaW5mb3JtaWVyZW4gU2llIGJpdHRlIHNvZm9ydCBkZW4KPiBBYnNlbmRlciwgbMO2 c2NoZW4gZGllc2UgRS1NYWlsIHVuZCB2ZXJuaWNodGVuIGFsbGUgS29waWVuLiBVU3QtSWROci46 Cj4gREUyOTA2NTQ3MTQsIEFtdHNnZXJpY2h0IEtvYmxlbnosIEhSQSAyMTYyNS4iCj4KPiBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+IFNlbnQgdGhyb3Vn aCB0aGUgRnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlzdAo+IGh0dHBzOi8vbm1hcC5vcmcvbWFp bG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQo+IFdlYiBBcmNoaXZlcyAmIFJTUzogaHR0cDov L3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8KCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBEaXNjbG9zdXJlIG1h aWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8vZnVsbGRpc2Nsb3N1 cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJl Lw==