<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The tint0 article is a little too far above my understanding of programming, but if the article's IMAP exploit is addressed via current patches on 8.7.11 and 8.8.10/11, then all we need to worry about is the memcache issue.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
And if I understand the article correctly (not sure I do, so asking here!), if I run:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="margin: 0px; font: 14px Menlo; margin: 0px"><span style="font-variant-ligatures: no-common-ligatures; font-variant-ligatures: no-common-ligatures">zmprov gs `zmhostname` zimbraMemcachedClientServerList</span></p>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
on all my nodes and I get nothing in return, then the system is NOT vulnerable to the tint0 memcache exploit.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is that correct?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mark</div>
<div id="signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;"><strong>_________________________________________________</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><strong>Another Message From... L. Mark Stone</strong></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><br>
</p>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Users <users-bounces@lists.zetalliance.org> on behalf of Info Zeta Alliance <info@zetalliance.org><br>
<b>Sent:</b> Tuesday, March 19, 2019 8:12 AM<br>
<b>To:</b> David Touitou<br>
<b>Cc:</b> users<br>
<b>Subject:</b> Re: [Users] Last security patch</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">The theory here <br>
<a href="https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html">https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html</a><br>
<br>
<br>
Is to have the Zimbra application make requests to itself via the proxy<br>
servlet, bypassing a firewall filter for port 7071 and memcached.<br>
<br>
<br>
If tint0 exploits work, than a port based firewall does not filter it.<br>
<br>
However the IMAP one, is already patched right.<br>
<br>
<a href="https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.10/P7">https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.10/P7</a><br>
<a href="https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.11/P3">https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.11/P3</a><br>
<br>
This is actually why one wants to have automatic upgrades, that also<br>
restart services if needed.<br>
<br>
<br>
Kind regards, <br>
<br>
Barry de Graaff<br>
Zeta Alliance <br>
Co-founder & Developer<br>
zetalliance.org | github.com/Zimbra-Community<br>
<br>
Signal: +31 617 220 227<br>
Fingerprint: 97f4694a1d9aedad012533db725ddd156d36a2d0<br>
<br>
<br>
<br>
Kind regards, <br>
<br>
Barry de Graaff<br>
Zeta Alliance <br>
Co-founder & Developer<br>
zetalliance.org | github.com/Zimbra-Community<br>
<br>
Signal: +31 617 220 227<br>
Fingerprint: 97f4694a1d9aedad012533db725ddd156d36a2d0<br>
<br>
----- Original Message -----<br>
From: "David Touitou" <david@network-studio.com><br>
To: "Victor d'Agostino" <d.agostino.victor@gmail.com><br>
Cc: "users" <users@lists.zetalliance.org><br>
Sent: Tuesday, 19 March, 2019 12:55:33<br>
Subject: Re: [Users] Last security patch<br>
<br>
Hi.<br>
<br>
> One of the Zimbra security recommendations is to block incoming memcache<br>
> connection from anywhere else than Zimbra servers.<br>
<br>
This was initialy to avoid using Zimbra's memcached for DDoS.<br>
<a href="https://www.cloudflare.com/learning/ddos/memcached-ddos-attack/">https://www.cloudflare.com/learning/ddos/memcached-ddos-attack/</a><br>
<br>
> Is Zimbra vulnerable if memcache service is filtered by iptables ?<br>
<br>
>From my understanding of the blog post, the memcached injection could be done throught ProxyServlet, even it is showned through direct http injection into memcached.<br>
<br>
Quoting: "Zimbra has quite a few SSRFs in itself, however there's only one place that suffices both conditions, and it happens to be the all-powerful ProxyServlet earlier."<br>
<br>
So it looks like it is vulnerable even if filtered.<br>
<br>
David<br>
<br>
</div>
</span></font></div>
</body>
</html>