Re: Critical Vulnerability in Ubiquiti UniFi
Tim Schughart <[email protected]> Mon, 3 Oct 2016 12:22:29 +0200
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
SGkgQ2FybG9zLCAKCnlvdSBhcmUgY29ycmVjdCB0aGF0IG1vbmdvIGlzIGJvdW5kIHRvIDEyNy4w LjAuMSBvbmx5LiBCdXQgeW91IGFyZSBhYmxlIHRvIGdldCBpdCByZW1vdGUgaWYgeW91IGFyZSB1 c2luZyB0aGUgVW5pZnkgQ29udHJvbGxlciBTb2Z0d2FyZS4gCgpTbyB0aGUgZGIgZ2V0cyB0dW5u ZWxlZCB0byB5b3VyIGRldmljZS4gCgpUZXN0IGVudmlyb25tZW50OiAKMS4gSSBoYXZlIGNvbmZp Z3VyZWQgdGhlIEFQIHRvIG91ciBuZXR3b3JrLiAKMi4gSSBoYXZlIHJlbW92ZWQgZXZlcnkgcGll Y2Ugb2Ygc29mdHdhcmUgZm9yIGNvbmZpZ3VyaW5nIHRoZSBhcC4gCjMuIEkgaGF2ZSBpbnN0YWxs ZWQgdGhlIFVuaWZ5IE1hbmFnZXIgKGZvciBNYWMgNS4yLjcuKQo0LiBJ4oCZbSBhYmxlIHRvIGNv bm5lY3QgdG8gdGhlIGRhdGFiYXNlIHZpYSAxMjcuMC4wLjEgCgpOZXR3b3JrIHRvcG9sb2d5OiAK VGhlIGFjY2VzcyBwb2ludCBpcyBjYWJsZWQgdG8gYSBBVk0gRnJpdHpCb3guIE91ciB0ZXN0IGNs aWVudCBpcyBjb25uZWN0ZWQgdmlhIFctTGFuIHByb3ZpZGVkIGJ5IEZyaXR6Qm94IC0gc28gdGhl cmUgaXMgbm8gZGlyZWN0IGNvbm5lY3Rpb24gdG8gdGhlIGFwLiAgCgoKQmVzdCByZWdhcmRzClRp bSBTY2h1Z2hhcnQKIAo+IEFtIDAxLjEwLjIwMTYgdW0gMTU6MzAgc2NocmllYiBDYXJsb3MgU2ls dmEgPHIzcGVrQHIzcGVrLm9yZz46Cj4gCj4gSGkgVGltIQo+IAo+IEkgY2FuIGJlIG1pc3Npbmcg c29tZXRoaW5nIGhlcmUgYnV0IEkganVzdCBjaGVja2VkIHRoaXMgb24gYSBmcmVzaCBpbnN0YWxs ZWQgVW5pZmkgQ29udHJvbGxlciBhbmQgbW9uZ29kIGlzIGJpbmRpbmcgdG8gbG9jYWxob3N0IG1h a2luZyB0aGlzIGEgbm9uLWlzc3VlLiBPciwgeW91IGhhdmUgdG8gZ2V0IGEgcmVtb3RlIHNoZWxs IGZpcnN0IGJlZm9yZSB5b3UgY2FuIGdldCBhIGNvbm5lY3Rpb24gdG8gdGhlIERCLiBBbSBJIG1p c3Npbmcgc29tZXRoaW5nPwo+IAo+IFRoYW5rcywKPiBDYXJsb3MgU2lsdmEKPiAKPiBPbiBGcmks IFNlcCAzMCwgMjAxNiBhdCAxMDo0OSBBTSwgVGltIFNjaHVnaGFydCA8dC5zY2h1Z2hhcnRAcHJv c2VjLW5ldHdvcmtzLmNvbT4gd3JvdGU6Cj4gSGVsbG8gQGFsbCwKPiAKPiB0b2dldGhlciB3aXRo IG15IGNvbGxlYWd1ZSB3ZSBmb3VuZCB0d28gdW5jcml0aWNhbCB2dWxuZXJhYmlsaXRpZXMgeW91 J2xsIGZpbmQgYmVsb3cuCj4gCj4gUHJvZHVjdDogVW5pRmkgQVAgQUMgTGl0ZQo+IFZlbmRvcjog VWJpcXVpdGkgTmV0d29ya3MgSW5jLgo+IAo+IEludGVybmFsIHJlZmVyZW5jZTogPyAoQnVnIElE KQo+IFZ1bG5lcmFiaWxpdHkgdHlwZTogSW5jb3JyZWN0IGFjY2VzcyBjb250cm9sCj4gVnVsbmVy YWJsZSB2ZXJzaW9uOiBVbmlmeSA1LjIuNyBhbmQgcG9zc2libGUgb3RoZXIgdmVyc2lvbnMgYWZm ZWN0ZWQgKG5vdCB0ZXN0ZWQpCj4gVnVsbmVyYWJsZSBjb21wb25lbnQ6IERhdGFiYXNlCj4gUmVw b3J0IGNvbmZpZGVuY2U6IHllcwo+IFNvbHV0aW9uIHN0YXR1czogTm90IGZpeGVkIGJ5IFZlbmRv ciwgdGhlIGJ1ZyBpcyBhIGZlYXR1cmUuCj4gRml4ZWQgdmVyc2lvbnM6IC0KPiBSZXNlYXJjaGVy IGNyZWRpdHM6IFRpbSBTY2h1Z2hhcnQsIEltbWFudWVsIELDpHIsIEtoYW5oIFF1b2MgUGhhbSBv ZiBQcm9TZWMgTmV0d29ya3MKPiBTb2x1dGlvbiBkYXRlOiAtCj4gUHVibGljIGRpc2Nsb3N1cmU6 IDIwMTYtMDktMzAKPiBDVkUgcmVmZXJlbmNlOiBDVkUtMjAxNi03NzkyCj4gQ1ZTU3YzOiA4Ljgg QVY6QS9BQzpML1BSOk4vVUk6Ti9TOlUvQzpIL0k6SC9BOkgKPiAKPiAKPiBWdWxuZXJhYmlsaXR5 IERldGFpbHM6Cj4gWW91IGFyZSBhYmxlIHRvIGNvbm5lY3QgdG8gdGhlIGFjY2VzcyBwb2ludHMg ZGF0YWJhc2UsIGJlY2F1c2Ugb2YgYW4gYnJva2VuIGF1dGhlbnRpY2F0aW9uIChPV0FTUCBUT1Ax MCkuIFNvIHlvdSBhcmUgYWJsZSB0byBtb2RpZnkgdGhlIGRhdGFiYXNlIGFuZCByZWFkIHRoZSBk YXRhLiBBbiBwb3NzaWJsZSBzY2VuYXJpbyB5b3UnbGwgZmluZCBpbiBQb0Mgc2VjdGlvbi4KPiAK PiBSaXNrOgo+IEFuIGF0dGFja2VyIGdldHMgYWNjZXNzIHRvIHRoZSBkYXRhYmFzZSBhbmQgZm9y IGUuZy4gaXMgYWJsZSB0byBjaGFuZ2UgdGhlIGFkbWlucyBwYXNzd29yZCwgbGlrZSB5b3Ugc2Vl IGluIFBvQyBiZWxvdy4KPiAKPiBQb0M6Cj4gIDEuIEdlbmVyYXRlIFNIQTUxMiBIYXNoIHdpdGgg ZS5nLgo+ICBta3Bhc3N3ZCAtbSBzaGEtNTEyCj4gCj4gIDIuIENvbm5lY3QgdmlhIG5ldHdvcmsg dG8gZGF0YWJhc2UsIGUuZy4gOgo+ICBtb25nbyAtLXBvcnQgMjcxMTcgLS1ob3N0IHRhcmdldF9p cAo+IAo+ICAzLiBDaGFuZ2UgcGFzc3dvcmQgdmlhIGNvbW1hbmQKPiAgImRiLmFkbWluLnVwZGF0 ZSh7Im5hbWUiOiJQcm9TZWMifSwgeyRzZXQgOiB7Inhfc2hhZG93IjoKPiAgIiQ2JFNlOWk1STdr M2hJOGQ0YmskQ3FFWFJVd2s3YzdBLzYyRS9IY0M0U3JNU0xPckJkbTd3UnZ3VFM0dC5uTkpBM1JZ dGEwUmZ6SnB1UkVnLnFjQUhzUEdXOUdqd20za3JKUk9YemJDdi4ifX0pIgo+ICA0LiBMb2dpbiB2 aWEgd2ViIGludGVyZmFjZSB3aXRoIG5ldyBwYXNzd29yZAo+IAo+IAo+IEJlc3QgcmVnYXJkcyAv IE1pdCBmcmV1bmRsaWNoZW4gR3LDvMOfZW4KPiAKPiAKPiBUaW0gU2NodWdoYXJ0Cj4gQ0VPIC8g R2VzY2jDpGZ0c2bDvGhyZXIKPiAKPiAtLQo+IFByb1NlYyBOZXR3b3JrcyBlLksuCj4gRWxsaW5n c2hvaGwgODIKPiA1NjA3NyBLb2JsZW56Cj4gCj4gV2Vic2l0ZTogaHR0cHM6Ly93d3cucHJvc2Vj LW5ldHdvcmtzLmNvbQo+IEUtTWFpbDogdC5zY2h1Z2hhcnRAcHJvc2VjLm5ldHdvcmtzLmNvbQo+ IE1vYmlsZTogKzQ5ICgwKTE1NyA3OTAxIDU4MjYKPiBQaG9uZTogKzQ5ICgwKTI2MSA0NTAgOTMw IDkwCj4gCj4gIlRoaXMgRS1NYWlsIGNvbW11bmljYXRpb24gbWF5IGNvbnRhaW4gQ09ORklERU5U SUFMLCBQUklWSUxFR0VEIGFuZC9vciBMRUdBTExZIFBST1RFQ1RFRCBpbmZvcm1hdGlvbiBhbmQg aXMgaW50ZW5kZWQgb25seSBmb3IgdGhlIG5hbWVkIHJlY2lwaWVudChzKS4gQW55IHVuYXV0aG9y aXplZCB1c2UsIGRpc3NlbWluYXRpb24sIGNvcHlpbmcgb3IgZm9yd2FyZGluZyBpcyBzdHJpY3Rs eSBwcm9oaWJpdGVkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50IGFuZCBo YXZlIHJlY2VpdmVkIHRoaXMgZW1haWwgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNlIG5v dGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5LCBkZWxldGUgaXQgYW5kIGRlc3Ryb3kgYWxsIGNv cGllcyBvZiB0aGlzIEUtTWFpbC4gVkFUIElEOiBERTI5MDY1NDcxNCBsZWdhbCBkb21pY2lsZSBL b2JsZW56LCBIUkEgMjE2MjUu4oCcCj4gCj4gIkRpZXNlIEUtTWFpbCBNaXR0ZWlsdW5nIGthbm4g VkVSVFJBVUxJQ0hFLCBkZW0gQkVSVUZTR0VIRUlNTklTIFVOVEVSTElFR0VOREUgdW5kL29kZXIg UkVDSFRMSUNIIEdFU0NIw5xUWlRFIEluZm9ybWF0aW9uZW4gZW50aGFsdGVuIHVuZCBpc3QgYXVz c2NobGllw59saWNoIGbDvHIgZGVuL2RpZSBnZW5hbm50ZW4gQWRyZXNzYXRlbiBiZXN0aW1tdC4g SmVkZSB1bmJlZnVndGUgTnV0enVuZywgV2VpdGVyZ2FiZSwgVmVydmllbGbDpGx0aWd1bmcgb2Rl ciBWZXJzZW5kdW5nIGlzdCBzdHJlbmdzdGVucyB2ZXJib3Rlbi4gU29sbHRlbiBTaWUgbmljaHQg ZGVyIGFuZ2VnZWJlbmUgQWRyZXNzYXQgc2VpbiB1bmQgZGllc2UgRS1NYWlsIE1pdHRlaWx1bmcg aXJydMO8bWxpY2ggZXJoYWx0ZW4gaGFiZW4sIGluZm9ybWllcmVuIFNpZSBiaXR0ZSBzb2ZvcnQg ZGVuIEFic2VuZGVyLCBsw7ZzY2hlbiBkaWVzZSBFLU1haWwgdW5kIHZlcm5pY2h0ZW4gYWxsZSBL b3BpZW4uIFVTdC1JZE5yLjogIERFMjkwNjU0NzE0LCBBbXRzZ2VyaWNodCBLb2JsZW56LCBIUkEg MjE2MjUuIgo+IAo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fCj4gU2VudCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0Cj4gaHR0 cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCj4gV2ViIEFyY2hp dmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLwo+IAoKCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0 aGUgRnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4v bGlzdGluZm8vZnVsbGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlz dHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==