June 2022 Summaries

This paragraph provides a concise summary of the text, covering key points without using lists or code. The vulnerability in unrar allows an attacker to execute arbitrary code on a vulnerable Zimbra instance by exploiting a path traversal bug in the unrar utility. This vulnerability can lead to pre-authenticated remote code execution (RCE) and is particularly concerning because it affects software that extracts RAR archives, such as Zimbra's spam checking and virus scanning services. The patch for this issue has been released by RarLab, and Zimbra has taken steps to mitigate the risk by configuring Amavis to use 7z instead of unrar to extract incoming RAR attachments.

In this blog post, we presented a Memcache Injection vulnerability in Zimbra that exists because newline characters are not escaped in untrusted user input. This code flaw ultimately allows attackers to steal cleartext credentials from users of targeted Zimbra instances. The vulnerability can be exploited by an attacker to steal the login credentials of known users without any user interaction, which can lead to a potential escalation of access within the targeted organization. The attack vector involves exploiting Memcache Injection vulnerabilities in Zimbra's Reverse Proxy and Memcached client, allowing attackers to hijack proxy connections of random users connecting to their IMAP server. Zimbra patched the vulnerability by creating a SHA-256 hash of all Memcache keys before sending them to the Memcached server, rendering the injection attack ineffective. The fixed versions are 8.8.15 with Patch level 31.1 and 9.0.0 with Patch level 24.1. It is recommended that developers be aware of special characters that should be escaped when dealing with technology where less documentation and research about potential vulnerabilities exist.

The performance goals for Sonar analysis have been defined to provide clear expectations for users and ensure consistent comparisons across different tools and outcomes. The goal is to analyze a project's first set of files in under 40 minutes, with specific target times depending on the project size, and code change analyses taking less than 1 minute for small changesets. Historical performance data shows that Sonar has made progress towards these goals, but there is still room for improvement, particularly for Java projects and pull requests containing a majority of Java code. To achieve this, the team plans to optimize pull request analysis time by leveraging a new cache mechanism storing project-level data, starting with Java projects before expanding to other languages. Users can contribute by providing feedback on improvements to confirm internal measurements of reduced overall analysis duration.