-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RUCKUS ADVISORY ID 031813-1 Customer release date: March 25, 2013 Public release date: May 27, 2013 TITLE Unauthenticated TCP tunneling on Ruckus devices via SSH server process SUMMARY An user authentication bypass vulnerability has been discovered during standard internal bug reporting procedures in some of the Ruckus devices. This vulnerability may permit an unauthenticated malicious user with network access to port 22 to tunnel random TCP traffic to other hosts on the network via Ruckus devices. AFFECTED SOFTWARE VERSIONS AND DEVICES Device Affected software branches - ------------------------- -------------------------- ZoneDirector Controllers 9.2.x, 9.3.x, 9.4.x, 9.5.x ZoneFlex Access Points 9.2.x, 9.3.x, 9.4.x, 9.5.x, 1.x.x SmartCell Access Points 1.x.x Smart Cell Gateway NOT AFFECTED Any products not mentioned in the table above are not affected DETAILS Ruckus allows for SSH connectivity to its devices for debuggability and maintenance reasons. It was discovered that a malicious user could abuse the TCP tunneling feature of the SSH daemon on Ruckus devices to proxy random TCP streams through the Ruckus devices. The user does not have to be authenticated to the Ruckus device for requesting and establishing such a tunnel. Once tunnel is established, the user's TCP stream would be carried over SSH to the Ruckus device, which would forward the traffic to an IP and port of the user's choosing. IMPACT An unauthenticated malicious user may be able to establish a SSH forwarding tunnel to a Ruckus device and use this tunnel to forward random TCP streams to other hosts in connectivity with the Ruckus device. SSH daemon is enabled by default on Ruckus devices. CVSS v2 BASE METRIC SCORE: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P) CHECK IF YOU ARE VULNERABLE - Malicious user requires network access to port 22 on the target Ruckus device to carry out this attack. - Smart Cell Gateway is NOT affected by this issue. WORKAROUNDS Ruckus recommends that all customers apply the appropriate patch(es) as soon as practical. However, in the event that a patch cannot immediately be applied, the following steps will help to mitigate the risk: - Do not expose management interfaces of Ruckus devices (including SSH access) to untrusted networks such as the Internet. - Use a firewall to limit SSH traffic to/from Ruckus devices to trusted hosts. - If limiting SSH access is not possible, an extreme workaround is to disable SSH access to the Ruckus device via a firewall in the path or via the HTTPS Web Interface of the device itself. SOLUTION Ruckus recommends that all customers apply the appropriate patch(es) as soon as practical. The following patches have the fix (any later patches will also have the fix): Branch Software Patch - --------- ------------------ 9.2.x ZF7731_9.2.0.0.168 9.3.x 9.3.4.0.17 9.4.x 9.4.3.0.16 9.5.x 9.5.1.0.50 1.x.x 1.1.1 OBTAINING FIXED FIRMWARE Ruckus customers can obtain the fixed firmware from the support website at https://support.ruckuswireless.com/ Ruckus Support can be contacted as follows: 1-855-RUCKUS1 (1-855-782-5871) (United States) e-mail: support at ruckuswireless.com The full contact list is at: https://support.ruckuswireless.com/contact-us PUBLIC ANNOUNCEMENTS This security advisory is strictly confidential and will be made available for public consumption in approximately 60 days on 27th May 2013 at the following source Ruckus Website http://www.ruckuswireless.com/security SecurityFocus Bugtraq http://www.securityfocus.com/archive/1 Future updates of this advisory, if any, will be placed on Ruckus's website, but may or may not be actively announced on mailing lists. REVISION HISTORY Revision 1.0 / 25th March 2013 / Initial release RUCKUS WIRELESS SECURITY PROCEDURES Complete information on reporting security vulnerabilities in Ruckus Wireless products, obtaining assistance with security incidents is available at http://www.ruckuswireless.com/security For reporting new security issues, email can be sent to security(at)ruckuswireless.com For sensitive information we encourage the use of PGP encryption. Our public keys can be found at http://www.ruckuswireless.com/security STATUS OF THIS NOTICE: Final Although Ruckus cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Ruckus does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Ruckus may update this advisory. (c) Copyright 2013 by Ruckus Wireless This advisory may be redistributed freely after the public release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJRpPiBAAoJEFH6g5RLqzh1pz8IAIF2ivet9IlUWxaY/QDkUpR6 8YmmEW+1pC0oKNxrem3ApvnVc3VZlqvZ5YO2Fc5i1U2G6zVpjRzbxOKSkCuGLpY+ xDS066Ey0rLyY51E/v4m1lUgcKe/+7KS+xtJ55BrlS/Hv6P8mg6f8Of89e0rUcOY 2EJyV3sXtwVINMrkY/U0zDgBMLIoEbajczaXfSpJSrDNBlXigMD/1HniZxqGPRna 3NiLbMuz9WCD6jug8NDDG2HBbQ8H07B4YREJnl7o65qsT1uH0sz5NVJyh2YVnIIx zMF+L1czzfTl2aE8kpQcFbC3a0nPeUeuOkCghsk8QwGGQVx1xAGrtp8QGomjaYU= =Qscm -----END PGP SIGNATURE-----