A flaw in unpatched Zimbra email servers could allow attackers to obtain remote code execution by pushing malicious files past filters.
Administrators running Zimbra servers are being warned to update their systems with the "pax" utility by researchers, who have observed cyberattackers actively attempting to exploit a known flaw.
Zimbra is a cloud-hosted email and employee collaboration platform. The bug, being tracked as CVE-2022-41352, exists in the virus-scan process for incoming emails; it could allow malicious files to get through, ultimately leading to remote code execution (RCE).
Synacor, the development company behind Zimbra, issued an alert to users on Sept. 14, warning admins they needed to install the pax package against the vulnerability,
Now, Rapid7 researchers said in a blog post that they have observed active exploitation of the flaw in the wild, and urged administrators who haven't already, to update their systems.
Synacor added that Ubuntu users should have already had the pax package installed automatically.
"The vulnerability is due to the method (cpio) in which Zimbra’s antivirus engine (Amavis) scans inbound emails," the Rapid7 team explained in an Oct. 6 blog post. "Zimbra has provided a workaround, which is to install the pax utility and restart the Zimbra services."
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024