Messaging and collaboration software maker Zimbra has rushed out patches to provide cover for a code execution flaw that has already been exploited to plant malware on target machines.

The Zimbra patches come more than a week after malware hunters at Rapid7 spotted signs of zero-day exploits hitting the Zimbra Collaboration (ZCS) suite.

The vulnerability, tracked as CVE-2022-41352, allows an attacker to plant a shell in the web root and achieve remote code execution.  The bug carries a CVSS severity score of 9.8/10 and could allow an attacker to use the cpio package to gain incorrect access to any other user accounts.

[ READ: Zoom for macOS Contains High-Risk Security Flaw ]

The company had previously issued a workaround recommending pax over cpio and acknowledged that an attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. 

The new Zimbra security updates also cover a medium-severity bug (CVE-2022-37393) with a CVSS score of 7.8/10.  “Zimbra’s sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters,” the company said in its documentation.

Zimbra patched multiple cross-site scripting (XSS) flaws that expose webmail users to information disclosure attacks.

The CVE-2022-41352 bug was identified in early September, after users started complaining of threat actors already launching exploits in live attacks.

By Ryan Naraine on Mon, 17 Oct 2022 15:55:24 +0000
Original link