Lawrence Abrams of Bleeping Computer has reported that there is a new ransomware variant, written in Python, that is targeting ZCS server data under /opt/zimbra/store/. Note: You might have read some articles about this issue, where the articles try to encourage the user to download software to remove a possible ransomware, usually this articles or pages are tools for Windows™ operating system […]
Archive | Security & Privacy
Zimbra Collaboration 8.7 and Zimbra Desktop, 2FA and Password Lock
By Jorge de la Cruz on May 16, 2016 in PowerTips – Admins, PowerTips – Users, Security & Privacy, Zimbra Desktop, Zimbra Server
Zimbra wants to offer better Security on our products, so I’m thrilled to introduce two new features that Zimbra Desktop 7.2.8 brings to the public. Zimbra Desktop – Password Lock Starting with Zimbra Desktop 7.2.8, the end user can protect Zimbra Desktop with a password. You will find this new feature in Preferences > All […]
Zimbra Collaboration 8.6 Patch 4 and previous (CWE-79, CVE-2015-7609) – XSS vulnerabilities
On December 22, 2015, we announced patch 5 for Zimbra Collaboration 8.6. Patch 5 contained fixes for eight security issues, including two cross-site scripting (XSS) vulnerabilities (assigned CVE-2015-7609) that were reported in October of 2015 by security researchers at Fortinet’s Fortiguard Labs. It was a pleasure working with one of the top security companies out there. If […]
OpenSSL July 2015 Update
On July 9, 2015, OpenSSL issued a security update to correct an issue opened by its June update. Specifically, this issue relates to alternative chains certificate forgery (CVE-2015-1793), i.e. an ability to “cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act […]
Logjam’s Impact on Zimbra Collaboration
Zimbra is aware of a newly disclosed SSL/TLS vulnerability that provides a potential malicious actor with a method to perform a Man-in-the-Middle (MitM) attack — the vulnerability is referred to as Logjam. Similar to FREAK, this attack targets export-grade encryption, specifically Diffie-Hellman key exchanges. For more information on the attack and how this applies to […]
General Availability: Zimbra Collaboration 8.6.0 Patch 2
By Matthew Lewis on May 6, 2015 in Open Source, Product Updates, Security & Privacy, Zimbra Web Client
As of yesterday, May 5, Zimbra Collaboration 8.6.0 patch 2 is generally available. This patch is cumulative with ZC 8.6.0 patch 1, meaning you only need to apply this patch to get the benefits of both. As noted in the release notes, the majority of bug fixes are for the Admin and Web UIs, with some minor […]