Weird Zimbra Vulnerability

Hackers can execute commands on a remote computer by sending malformed emails to a Zimbra mail server. It’s critical, but difficult to exploit.

In an email sent Wednesday afternoon, Proofpoint researcher Greg Lesnewich seemed to largely concur that the attacks weren’t likely to lead to mass infections that could install ransomware or espionage malware. The researcher provided the following details:

  • While the exploitation attempts we have observed were indiscriminate in targeting, we haven’t seen a large volume of exploitation attempts
  • Based on what we have researched and observed, exploitation of this vulnerability is very easy, but we do not have any information about how reliable the exploitation is
  • Exploitation has remained about the same since we first spotted it on Sept. 28th
  • There is a PoC available, and the exploit attempts appear opportunistic
  • Exploitation is geographically diverse and appears indiscriminate
  • The fact that the attacker is using the same server to send the exploit emails and host second-stage payloads indicates the actor does not have a distributed set of infrastructure to send exploit emails and handle infections after successful exploitation. We would expect the email server and payload servers to be different entities in a more mature operation.
  • Defenders protecting Zimbra appliances should look out for odd CC or To addresses that look malformed or contain suspicious strings, as well as logs from the Zimbra server indicating outbound connections to remote IP addresses.

Posted on October 3, 2024 at 7:04 AM0 Comments

Sidebar photo of Bruce Schneier by Joe MacInnis.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

ISC2 ISSMP® Training Boot Camp

This four-day Information Systems Security Management Professional (ISSMP) Boot Camp focuses on professional management experience and how it relates to a larger enterprise-wide security model. You’ll learn deeper managerial elements

ONNX Phishing Targets Financial Companies’ Microsoft 365 Accounts

ONNX Store new PhaaS is targeting Microsoft 365 and Office 365 accounts in financial companies. The hackers use QR codes in PDF attachments to lure the employees into clicking malicious

“All for One and One for All”: The EU Cyber Solidarity Act Strengthens Digital Defenses

Alexandre Dumas’s timeless novel “The Three Musketeers” immortalized the ideal of unyielding solidarity, the enduring motto “All for one and one for all.” In the face of ever-evolving threats in