<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We did not get any advance notice Fabio. I can't speak for other Partners.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have spoken several times with senior Zimbra execs that failing to disclose exploitable security exploits to partners in advance invites bad actors to attempt to perform the exploits.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As a BSP, I was particularly disappointed about the cross-domain GAL search exploit that was fixed in a recent patch.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Usually, we like to test patches before deploying them, but in that case we felt we had no choice but to apply the patch immediately.</div>
<br>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mark<br>
</div>
<div id="Signature">
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px"><strong>_________________________________________________</strong></p>
<div style="margin-top:0px; margin-bottom:0px">
<div><span style="font-size:10pt"><strong>L. Mark Stone, Founder</strong></span></div>
<div><span style="font-size:10pt"><strong></strong></span><br>
</div>
<div><img src="https://s3.amazonaws.com/public.missioncriticalemail.com/MissionCriticalEmail+Logo-Horizontal-01-Cropped-300x45.png"></div>
<div><em><span style="font-size:10pt"><strong>North America's Leading Zimbra VAR/BSP/Training Partner</strong></span></em></div>
<div><em><span style="font-size:10pt"><strong>For Companies With Mission-Critical Email Needs</strong></span></em></div>
<div><em><span style="font-size:10pt"><strong>Need more email security & compliance? Ask me about Mimecast!</strong></span></em></div>
<br>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Users <users-bounces@lists.zetalliance.org> on behalf of Fabio S. Schmidt <fabio@bktech.com.br><br>
<b>Sent:</b> Wednesday, June 3, 2020 10:51 PM<br>
<b>To:</b> users <users@lists.zetalliance.org><br>
<b>Subject:</b> [Users] Zimbra vulnerability fix in the new patches released today</font>
<div> </div>
</div>
<div>
<div style="font-family:arial,helvetica,sans-serif; font-size:12pt; color:#000000">
<div>Hello Guys,</div>
<div><br>
</div>
<div>Have you seen the 8.8.15 P10 and 9.0 P3 patches released today?</div>
<div><br>
</div>
<div><a href="https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3">https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3</a><br>
</div>
<div><a href="https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P10">https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P10</a><br>
</div>
<div><br>
</div>
<div>There is a fix for this vulnerabity mentioned:</div>
<div><br>
</div>
<div><a href="https://vulmon.com/vulnerabilitydetails?valert=email&qid=CVE-2020-12846">https://vulmon.com/vulnerabilitydetails?valert=email&qid=CVE-2020-12846</a><br>
</div>
<div><br>
</div>
<div><strong>Zimbra prior to 8.8.15 Patch 10 and 9.x prior to 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in
the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.</strong><br>
</div>
<div><strong><br>
</strong></div>
<div>Did any partner receive a warning from Zimbra about this before the patches were released? </div>
<div><br>
</div>
<div>Best regards.</div>
<div>Fabio S. Schmidt</div>
</div>
</div>
</body>
</html>