Messaging and collaboration software maker Zimbra has rushed out patches to provide cover for a code execution flaw that has already been exploited to plant malware on target machines.
The Zimbra patches come more than a week after malware hunters at Rapid7 spotted signs of zero-day exploits hitting the Zimbra Collaboration (ZCS) suite.
The vulnerability, tracked as CVE-2022-41352, allows an attacker to plant a shell in the web root and achieve remote code execution. The bug carries a CVSS severity score of 9.8/10 and could allow an attacker to use the cpio package to gain incorrect access to any other user accounts.
[ READ: Zoom for macOS Contains High-Risk Security Flaw ]
The company had previously issued a workaround recommending pax over cpio and acknowledged that an attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts.
The new Zimbra security updates also cover a medium-severity bug (CVE-2022-37393) with a CVSS score of 7.8/10. “Zimbra’s sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters,” the company said in its documentation.
Zimbra patched multiple cross-site scripting (XSS) flaws that expose webmail users to information disclosure attacks.
The CVE-2022-41352 bug was identified in early September, after users started complaining of threat actors already launching exploits in live attacks.
Related: Critical Zimbra RCE Vulnerability Exploit as Zero-Day
Related: Zero-Day Vulnerability Exploited to Hack Over 1,000 Zimbra Email Servers
Related: Zimbra Credential Theft Vulnerability Exploited in Attacks
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Microsoft Catches Chinese .Gov Hackers Targeting US Critical Infrastructure
- Researchers Spot APTs Targeting Small Business MSPs
- Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own
- Red Hat Pushes New Tools to Secure Software Supply Chain
- Investors Make $6M Bet on Manifest for SBOM Management Technology
- Entro Raises $6M to Tackle Secrets Sprawl
- IBM Snaps up DSPM Startup Polar Security
- Huntress Closes $60M Series C for MDR Expansion
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
