REDHAT-BUG-1059903: High severity Zarafa zarafa-server vulnerability
I discovered (aside bug #1056767) another flaw in Zarafa that could allow a remote unauthenticated attacker to crash the zarafa-server daemon, preventing access to any other legitimate Zarafa users.
The issue affects all Zarafa versions from at least Zarafa 6.20.0 (maybe even from at least Zarafa 5.00) up to (including) Zarafa 7.1.8 final. Please note that I was not able to crash the zarafa-server daemon using official upstream Zarafa binary packages just all community builds from the source code such as shipped in Fedora. This different behaviour might be caused that upstream uses different built-time flags or other system libraries and headers.
Once the zarafa-server process crashes with a backtrace (and even all other Zarafa related daemons are still running) there is no Zarafa functionality till zarafa-server daemon is started again. The zarafa-server process provides the MAPI in SOAP service required by all other Zarafa related components as shown: http://doc.zarafa.com/trunk/AdministratorManual/en-US/html/architecture.html
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1059903?
The severity of REDHAT-BUG-1059903 primarily relates to an unauthenticated denial of service vulnerability in Zarafa.
How do I fix REDHAT-BUG-1059903?
To resolve REDHAT-BUG-1059903, you should update Zarafa to a patched version that addresses the vulnerability.
Which versions of Zarafa are affected by REDHAT-BUG-1059903?
REDHAT-BUG-1059903 affects Zarafa versions between 6.20.0 and 7.1.8 inclusive.
What is the impact of the vulnerability described in REDHAT-BUG-1059903?
The impact of REDHAT-BUG-1059903 allows attackers to cause a denial of service, impacting the availability of the Zarafa server.
Is REDHAT-BUG-1059903 related to any other vulnerabilities?
Yes, REDHAT-BUG-1059903 is related to a previous vulnerability identified as bug #1056767.