#Zimbra spamassassin configuration archive#
#Zimbra spamassassin configuration Patch#
#Zimbra spamassassin configuration software#

The vulnerable and patched version can differ depending on the Linux distribution you use and from which repository the binaries were downloaded. Only the Unix binaries (excluding Android) are affected by this vulnerability.

#Zimbra spamassassin configuration Patch#

The official security patch by RarLab is contained in the UnRar source code version 6.1.7 and is included with the binaries of version 6.12.

#Zimbra spamassassin configuration archive#

The only requirement for this attack is that unrar is installed on the server, which is expected as it is required for RAR archive virus-scanning and spam-checking. With this access, it is likely that they can escalate their access to even more sensitive, internal services of an organization. They can silently backdoor login functionalities and steal the credentials of an organization's users. In the case of Zimbra, successful exploitation gives an attacker access to every single email sent and received on a compromised email server. If they can write to a known location, they are likely to be able to leverage it in a way leading to the execution of arbitrary commands on the system. We identified a File Write vulnerability(CVE-2022-30333) in the unrar binary developed by RarLab, the same company that develops WinRAR.Īn attacker is able to create files outside of the target extraction directory when an application or victim user extracts an untrusted archive.

#Zimbra spamassassin configuration software#

Although this blog post focuses on Zimbra to demonstrate the impact of this bug, any software relying on an unpatched version of unrar to extract untrusted archives is affected. In this section we go into detail about which versions of unrar are affected.

The vulnerability ultimately allows a remote attacker to execute arbitrary code on a vulnerable Zimbra instance without requiring any prior authentication or knowledge about it. As a result, we discovered a 0-day vulnerability in the unrar utility, a 3rd party tool used in Zimbra. In this blog post, we present how our research team approached Zimbra by taking on the perspective of an APT group. Classified documents could be stolen, passwords reset, and members of an organization impersonated to compromise more accounts. The fact that a 0-day vulnerability was used to steal emails from individual user accounts shows how valuable a compromised email account is to an attacker and how disastrous the impact of such vulnerabilities is on an organization. Zimbra instances recently became a target of a 0-day attack campaign, likely conducted by a state actor who targeted European government and media instances. Zimbra is an enterprise-ready email solution used by over 200,000 businesses, government and financial institutions. By sharing our findings from this perspective, we also aim to provide useful insights and learnings to the community. To uncover and understand complex vulnerabilities in high-profile applications, our researchers need to take the perspective of real-world attackers.

At Sonar, we are studying real-world vulnerabilities to improve our code analyzers, and to help the open-source community to secure their projects.