RUCKUS ADVISORY ID 10282013 - User authentication bypass vulnerability in Ruckus Access Point's administrative web interface

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

RUCKUS ADVISORY ID 10282013

Customer release date: Oct 28, 2013
Public release date: Nov 28, 2013

TITLE

User authentication bypass vulnerability in Ruckus Access Point's
administrative web interface

SUMMARY

An user authentication bypass vulnerability has been discovered in
Ruckus Access Point's administrative web interface. This vulnerability
may allow a malicious user to gain unauthorized access to the
administrative web interface.

AFFECTED SOFTWARE VERSIONS AND DEVICES

Device            Affected software

---

ZoneFlex Access Points 9.5.x, 9.6.x

Any products not mentioned in the table above are not affected

DETAILS

A weakness has been discovered in the administrative web interface of
the Ruckus Access Point devices. A malicious user with network access
to the device's web interface may obtain unauthorized access and
perform administrative actions via the web interface.

The user does not have to be authenticated to the web interface for
this attack to be successful. This issue does not affect any other
Ruckus devices besides Ruckus Access Point devices.

IMPACT

A malicious user with network access to the administrative web
interface of the Ruckus Access Point device may obtain unauthorized
access and perform administrative actions via this interface.

CVSS v2 BASE METRIC SCORE: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

WORKAROUNDS

Ruckus recommends that all customers apply the appropriate patch(es)
as soon as practical. However, in the event that a patch cannot
immediately be applied, the following suggestions might help reduce
the risk:

• Do not expose management interfaces of Ruckus devices (including
  administrative web interface) to untrusted networks such as the Internet.

• Use a firewall to limit traffic to/from Ruckus Access Point's
  administrative web interface to trusted hosts.

SOLUTION

Ruckus recommends that all customers apply the appropriate patch(es)
as soon as practical.

The following patches have the fix (any later patches will also have
the fix):

Branch Software Patch

---

9.5.x 9.5.3.0.44MR
9.6.x 9.6.1.0.15MR

CREDITS

This vulnerability was discovered and responsibly disclosed to Ruckus
Wireless by multiple sources:

• • • David Peters of Ansecurity
• • • Neil Lines of Nettitude Group

This issue has also been reported to CERT and NVD by a third party
without informing Ruckus Wireless.

http://www.kb.cert.org/vuls/id/742932
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5030

OBTAINING FIXED FIRMWARE

Ruckus customers can obtain the fixed firmware from the support website at
https://support.ruckuswireless.com/

Ruckus Support can be contacted as follows:

1-855-RUCKUS1 (1-855-782-5871) (United States)

The full contact list is at:
https://support.ruckuswireless.com/contact-us

PUBLIC ANNOUNCEMENTS

This security advisory is strictly confidential and will be made
available for public consumption on Nov 28, 2013 at the following source

Ruckus Website
http://www.ruckuswireless.com/security

SecurityFocus Bugtraq
http://www.securityfocus.com/archive/1

Future updates of this advisory, if any, will be placed on Ruckus's
website, but may or may not be actively announced on mailing lists.

REVISION HISTORY

  Revision 1.0 / 28th Nov 2013 / Initial release

RUCKUS WIRELESS SECURITY PROCEDURES

Complete information on reporting security vulnerabilities in Ruckus
Wireless
products, obtaining assistance with security incidents is available at
http://www.ruckuswireless.com/security

For reporting new security issues, email can be sent to
security(at)ruckuswireless.com
For sensitive information we encourage the use of PGP encryption. Our
public keys can be
found at http://www.ruckuswireless.com/security

STATUS OF THIS NOTICE: Final

Although Ruckus cannot guarantee the accuracy of all statements
in this advisory, all of the facts have been checked to the best of our
ability. Ruckus does not anticipate issuing updated versions of
this advisory unless there is some material change in the facts. Should
there be a significant change in the facts, Ruckus may update this
advisory.

(c) Copyright 2013 by Ruckus Wireless
This advisory may be redistributed freely after the public release
date given at
the top of the text, provided that redistributed copies are complete and
unmodified, including all date and version information.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJSlnB/AAoJEFH6g5RLqzh1hoUIAMooTly+eiCi+xXnb5u7U9mW
/HrBYdf6ayAIllwtBtbdeWCJd8bpxMeJzYdOY21zNQMWmUzkIREUtMqJRlHrOflT
EVqQc67b+SPyGb46nKUoMe8IkYw0ZT/HBWAqbkD1CZqaXR9aPbfKvdksbQvWhXks
fBTTowuvs7Ez/2FeJfZIBp3g2skK+1PwZxK8+S/AC0Mlen2MVLJNOf7ZBreZLN9f
7Xa1ZRRI4j3ehvYshUWdDS0c54Nd591PrGgFMpvWbmmOTzRRKqdzOYTanMsmbTSv
Qjpu3wwbDVKuz8n7dIigOBjxHnoJqR4TbbRtYU3JOJlpwTWURif89PP45slX4vY=
=pNjb
-----END PGP SIGNATURE-----