Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite

Zimbra has launched patches to comprise an actively exploited security flaw in its company collaboration suite that could be leveraged to upload arbitrary files to susceptible occasions.

Tracked as CVE-2022-41352 (CVSS score: 9.8), the issue influences a ingredient of the Zimbra suite identified as Amavis, an open up resource information filter, and far more specifically, the cpio utility it employs to scan and extract archives.

The flaw, in flip, is stated to be rooted in another underlying vulnerability (CVE-2015-1197) that was first disclosed in early 2015, which in accordance to Flashpoint was rectified, only to be subsequently reverted in afterwards Linux distributions.

“An attacker can use cpio bundle to obtain incorrect access to any other user accounts,” Zimbra said in an advisory posted previous week, incorporating it “endorses pax in excess of cpio.”

Fixes are out there in the pursuing versions –

• Zimbra 9.. Patch 27
• Zimbra 8.8.15 Patch 34

All an adversary in search of wants to do to weaponize the shortcoming is to send an email with a specifically crafted TAR archive attachment that, upon getting obtained, gets submitted to Amavis, which makes use of the cpio module to induce the exploit.

Cybersecurity enterprise Kaspersky has disclosed that unfamiliar APT groups have actively been using gain of the flaw in the wild, with a person of the actors “systematically infecting all vulnerable servers in Central Asia.”

The assaults, which unfolded around two attack waves in early and late September, generally specific governing administration entities in the location, abusing the original foothold to fall web shells on the compromised servers for comply with-on pursuits.

Centered on info shared by incident response company Volexity, approximately 1,600 Zimbra servers are believed to have been infected in what it phone calls a “blend of qualified and opportunistic assaults.”

“Some web shell paths […] had been employed in qualified (most likely APT) exploitation of key corporations in federal government, telecommunications, and IT, predominantly in Asia others have been used in large around the world exploitation,” the company said in a sequence of tweets.

Uncovered this post intriguing? Adhere to THN on Facebook, Twitter  and LinkedIn to read through far more exclusive content material we put up.

Some parts of this article are sourced from:
thehackernews.com