Critical Security: Patch for OpenSSL Heartbleed Vulnerability

The OpenSSL Heartbleed bug (CVE-2014-0160) allows an attacker to send a malformed heartbeat message to a target, which then returns data stored in memory. Each attack can retrieve 64 kilobytes of data. By repeating the attack, an attacker may obtain all the information they want, such as email exchanged between a client and server. If an attacker obtains private keys, they may be able to intercept and read communication between the server whose private encryption keys were stolen and its clients. Zimbra Collaboration Server 8 is also affected by the OpenSSL Heartbleed bug because it uses OpenSSL 1.0.1e, which is among the versions affected by this OpenSSL security flaw. The affected components are nginx, postfix and OpenLDAP, which use Zimbra’s own OpenSSL. Other components use the OS openssl libraries. UPDATE: *Zimbra 8.0.7 8.0.7 build 6021 has already fixed Heartbleed. Users who upgrade to ZCS 8.0.7 build 6021 therefore do not need to apply the Heartbleed patch again. Fixing the OpenSSL Heartbleed bug (CVE-2014-0160) Apply the fix to both the OS and Zimbra Collaboration Server 8 as follows.

1. On Zimbra Zimbra has released an OpenSSL patch for versions 8.0.3 - 8.0.7 (8.0.0 - 8.0.2 are not supported). Administrators should follow these steps to fix the OpenSSL Heartbleed bug.

   1. Log in as root.

   2. Run the command:

      wget http://files.zimbra.com/downloads/security/zmopenssl-updater.sh
      chmod a+rx zmopenssl-updater.sh

   3. Run the command to patch the openssl security issue: sh zmopenssl-updater.sh Output:

      ---------------------
      [Generates the following output]
      Downloading patched openssl
      Validating patched openssl: success
      Backing up old openssl: complete
      Installing patched openssl: complete
      OpenSSL patch process complete.
      Please restart Zimbra Collaboration Suite as the Zimbra user via zmcontrol
      restart
      ---------------------

   4. Restart zimbra. /etc/init.d/zimbra restart

2. On the OS, update openssl to the following version:

• 1.0.1e-16.el6_5.7 on RedHat 6 / CentOS 6
• 1.0.1-4ubuntu5.12 on Ubuntu 12.04 LTS
• SLES11 and UBUNTU10_64SuSe are not affected at the OS level.