Messaging and collaboration software maker Zimbra has rushed out patches to provide cover for a code execution flaw that has already been exploited to plant malware on target machines.
The Zimbra patches come more than a week after malware hunters at Rapid7 spotted signs of zero-day exploits hitting the Zimbra Collaboration (ZCS) suite.
The vulnerability, tracked as CVE-2022-41352, allows an attacker to plant a shell in the web root and achieve remote code execution. The bug carries a CVSS severity score of 9.8/10 and could allow an attacker to use the cpio package to gain incorrect access to any other user accounts.
[ READ: Zoom for macOS Contains High-Risk Security Flaw ]
The company had previously issued a workaround recommending pax over cpio and acknowledged that an attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts.
The new Zimbra security updates also cover a medium-severity bug (CVE-2022-37393) with a CVSS score of 7.8/10. “Zimbra’s sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters,” the company said in its documentation.
Zimbra patched multiple cross-site scripting (XSS) flaws that expose webmail users to information disclosure attacks.
The CVE-2022-41352 bug was identified in early September, after users started complaining of threat actors already launching exploits in live attacks.
Related: Critical Zimbra RCE Vulnerability Exploit as Zero-Day
Related: Zero-Day Vulnerability Exploited to Hack Over 1,000 Zimbra Email Servers
Related: Zimbra Credential Theft Vulnerability Exploited in Attacks
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Microsoft Catches Chinese .Gov Hackers Targeting US Critical Infrastructure
- Researchers Spot APTs Targeting Small Business MSPs
- Mikrotik Belatedly Patches RouterOS Flaw Exploited at Pwn2Own
- Red Hat Pushes New Tools to Secure Software Supply Chain
- Investors Make $6M Bet on Manifest for SBOM Management Technology
Latest News
- KeePass Update Patches Vulnerability Exposing Master Password
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
