Software/Security Updates for Zimbra

autospy · Post by **autospy** » Tue Jun 19, 2007 12:36 pm

I work for a medium sized department in a large public University. We're currently testing the open source version of Zimbra for future deployment to replace our existing system (based on iPlanet). Thus, far we've been satisfied with the performance of Zimbra.
We have yet to engage the sales team, but before we do we have a few questions for the community.
- Does Zimbra have some mechanism to deal with security updates? For example, there were multiple DoS attacks reported for ClamAV in the past few weeks. (see CVE-2007-3123 (under review)). Updating the OS (RHEL 4 in our case) alone does solve the problem, because Zimbra runs its own ClamAV. I've seen some wiki posts on updating it manually, but that doesn't seem practical as it overwrites the Zimbra binaries (and might not be "certified" to work with Zimbra).
- Is there a (low-volume) mailing that one can subscribe to and receive security only announcements related to Zimbra?
Thanks in Advance.

autospy · Post by **autospy** » Mon Jun 25, 2007 11:06 am

I suppose no one here is interested in updates to security holes. I'm wondering how administrator's are handling security updates? On our secondary mail servers (clamav/postfix/etc) we've been relying on Redhat updates, so I'm a reluctant to go with Zimbra unless they are taking security seriously.

14319KevinH · Post by **14319KevinH** » Mon Jun 25, 2007 11:11 am

[quote user="autospy"]I suppose no one here is interested in updates to security holes. I'm wondering how administrator's are handling security updates? On our secondary mail servers (clamav/postfix/etc) we've been relying on Redhat updates, so I'm a reluctant to go with Zimbra unless they are taking security seriously.[/QUOTE]
We take it seriously and currently ship security updates as part of each patch release. At this time we have not created a security maillist but do at times send out notifications to our customer list first and then post on the forums a day or two later when there are security issues that can be fixed with a config change. This has only happened twice that I can remember.

2234msallee · Post by **2234msallee** » Wed Dec 09, 2009 12:43 pm

I would also be interested in subscribing to a security-updates only notification list. (for Zimbra NE.) Is there one available yet?

Thank you.
Mark

chauvetp · Post by **chauvetp** » Wed Dec 09, 2009 1:12 pm

It would be nice if the updates were posted on zimbrablog.com or even @zimbra on twitter.