Ubiquiti Network Gear Targeted By Worm

ISP equipment maker Ubiquiti Networks is fending off a stubborn worm targeting its networking equipment running outdated AirOS firmware. According to security experts, the worm is already being blamed for crippling networking gear in the Argentina, Brazil, Spain and the United States. Ubiquiti...

AirOS 6.x - Arbitrary File Upload

Exploit for cgi platform in category web applications EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's...

AirOS 6.x Arbitrary File Upload

Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability. Example Consider the following request:...

Ubiquiti Inc.: Yet another Buffer Overflow in PHP of the AirMax Products

It's me again! After the Report 73491 and the 74004, I bring another Buffer Overflow, this one look more like 74004, which is a overflow in stack. Has you can see bellow, is copied to the var line a content POST data in this case which can go beyond the content of the original variable. int...

Ubiquiti Inc.: Other Buffer Overflow in PHP of the AirMax Products

tldr: Just like happen in Report 73491, but MUCH WORSE. The Vulnerability After the Report 73491, I decided to take another look in the code on filespost.c and uploadbuffer.c once I have nothing better to do than watch F1. The problematic code: char getpostvoid / Some Code / char mb; char...

Ubiquiti Inc.: Buffer Overflow in PHP of the AirMax Products

Vulnerability The function static int ubnormalizefilenamechar filename implemented by the patch 430-smart-post-upload.patch in the file uploadbuffer.c on the SDK.UBNT.v5.5 have the following code: static int ubnormalizefilenamechar filename char fwdslash; char backslash; sizet size; / Some commen...