All Zimbra administrators should make sure the
If the pax package is not installed, Amavis will fall-back to using cpio, unfortunately the fall-back is implemented poorly (by Amavis) and will allow an unauthenticated attacker to create and overwrite files on the Zimbra server, including the Zimbra webroot.
For most Ubuntu servers the pax package should already be installed as it is a dependency of Zimbra. Due to a packaging change in CentOS, there is a high chance pax is not installed.
You should validate and install pax on all your systems as follows:
Ubuntu
apt install pax
CentOS 7 and derivatives
yum install pax
CentOS 8 and derivatives
dnf install spax
Restart Zimbra using:
sudo su zimbra -
zmcontrol restart
This issue will also be addressed in the next Zimbra patch where we will make pax a requirement of Zimbra.
hi Barry,
what if the zimbra multiserver package is installed on all servers?
yes do install it on all servers.
Thank you for the information. Just about all of our instances (mainly CentOS) did not have pax installed. I have read that there have already been documented attacks to the CVE-2022-41352. Are there already ways to detect an infection?
You can use the following approach: https://wiki.zimbra.com/wiki/Integrity_check
Thanks for the link to https://wiki.zimbra.com/wiki/Integrity_check. Comparing checksums of Zimbra files to make sure that no files have been tampered with by Zimbra is a good method. However, the check only makes sense if you have “previously” done dumps of the files’ checksums. If no dumps or filesystem backups of all Zimbra files were made, this checkup is useless, because no comparison can be made. Also with updates the checksums should change and thus lead to errors. It would be better if Zimbra maintained checksums, per version and distribution.
For my use case, the provided check for compression of the system is not a practical solution to be sure that our system has not been changed, since I have no comparison values/comparison checksums.
If you have no backup or snapshot of your system from an earlier date, then indeed the script cannot help you. We do intend to make changes to our repositories and packaging so that the checksum can be validated that way. Unfortunately that takes time and till then the script is best we can do.
Thank you for the answer. We only backup the user data and configuration but not the binaries of Zimbra. I like the approach of the script very much and it will help to verify the integrity of our zimbra instaces. I will put it in a routine check with a small monitoring alert. I am looking forward to further developments.
Barry,
Many customers ask me if it is useful to disable amavis and use an external service? but I am not sure if this will protect them when processing internal (local) mails.
It is a good strategy to consider, normally internal email will not be scanned by an external service, but likely internal threats can be mitigated better with end-point protection. Amavis probably will not catch all the newest threats.