Zimbra is aware of a newly disclosed SSL/TLS vulnerability that provides a potential malicious actor with a method to perform a Man-in-the-Middle (MitM) attack — the vulnerability is being referred to as FREAK (Factoring attack on RSA-EXPORT Keys). For more information on the attack and how this applies to Zimbra, please head over to the […]
Archive | Security & Privacy
When is a Lock, Not a Lock?
January was an interesting month for cryptography. The UK Prime Minister made some very strong statements about digital communication, essentially calling for strong encryption to be shirked by providing law enforcement with a back door. The US National Institute of Standards and Technology (NIST) announced the deprecation of several Federal Information Processing Standards (FIPS), one […]
Half of All Email Systems will be Replaced in Two Years
Today, Zimbra announced the results of the Ponemon Institute’s “The Open Source Collaboration Study: Viewpoints on Security and Privacy in the U.S. and EMEA” report. Sponsored by Zimbra, the study surveyed 1,398 IT and IT security practitioners to learn about their companies’ involvement in the use of open source messaging and collaboration solutions, and their […]
Zimbra Collaboration Updates (8.0.9 & 8.5.1)
Yesterday, Zimbra released updates to Zimbra Collaboration, both the 8.0.x and 8.5.x trees. Security These updates address the OpenSSL security advisory dated October 15 and provide a partial fix for POODLE (due to the need for both client and server changes). Zimbra Collaboration 8.0.9 and 8.5.1 update the OpenSSL libraries for nginx, OpenLDAP and Postfix […]
POODLE and SSLv3
This week has brought about the latest security vulnerability. Google’s Thai Duong, Krzysztof Kotowicz, and Bodo Möller made the vulnerability — POODLE (Padding Oracle On Downgraded Legacy Encryption) — public on Tuesday, October 14, 2014. POODLE is a padding oracle attack affecting Secure Sockets Layer (SSL) version 3 and in particular, CBC-mode ciphers. This vulnerability […]
The Shellshock Flaw
***Security Alert*** [Update 2 | September 30, 2014, 9:10am CST] Apple has released at update. [Update 1 | September 26, 2014, 11:40am CST] Red Hat has released a full patch. [Original Post | September 25, 2014, 1:45pm CST] Zimbra is aware and has been closely monitoring the developments of the Shellshock vulnerability. At this time, […]