Multiple vulnerabilities in Zimbra Collaboration



Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2022-0778
CVE-2021-28165
CVE-2019-0231
CWE-ID CWE-835
CWE-400
CWE-319
CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Zimbra Collaboration
Web applications / Webmail solutions

Vendor Synacor Inc.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU61391

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-0778

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zimbra Collaboration: 8.8.15 Patch 1 - 9.0.0

CPE2.3 External links

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P25#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P32#Security_Fixes


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Resource exhaustion

EUVDB-ID: #VU51876

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-28165

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing large TLS frames. A remote attacker can send specially crafted data to the server, trigger CPU high load and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zimbra Collaboration: 8.8.15 Patch 1 - 9.0.0

CPE2.3 External links

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P25#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P32#Security_Fixes


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cleartext transmission of sensitive information

EUVDB-ID: #VU26209

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-0231

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect handling of close_notify SSL/TLS messages that results in software not closing the connection and retaining the socket opened, which allows a client to receive clear text messages afterward. A remote attacker can intercept traffic between client and server application and gain access to potentially sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zimbra Collaboration: 8.8.15 Patch 1 - 9.0.0

CPE2.3 External links

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P25#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P32#Security_Fixes


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site scripting

EUVDB-ID: #VU66157

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when displaying attachments data. A remote attacker can trick the victim to open a specially crafted attachment and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zimbra Collaboration: 8.8.15 Patch 1 - 9.0.0

CPE2.3 External links

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P25#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P32#Security_Fixes


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###