Re: CVE-2019-9670 being actively exploited
Posted: Fri May 03, 2019 9:22 am
Here you are:halfgaar wrote:Eritea, I think you're confusing things. Your contents on /tmp and that process seem normal.
The script that the wget command in cron downloads shows what is done. It's posted a page back, go look at it.
And, clean your crontab.
And what files have a mismatched hash? Can you post it?
Code: Select all
root@mail:/download# dpkg -l zimbra* | grep ^ii | awk '{print $2}' | xargs debsums -c
/opt/zimbra/conf/localconfig.xml
/opt/zimbra/lib/jars/zimbrastore.jar
/opt/zimbra/lib/jars/zimbracommon.jar
/opt/zimbra/lib/jars/zimbrasoap.jar
/opt/zimbra/common/etc/java/cacerts
/opt/zimbra/common/lib/perl5/XML/SAX/ParserDetails.ini
/opt/zimbra/common/conf/main.cf
/opt/zimbra/common/conf/master.cf
/opt/zimbra/conf/templates/templates/calendar/Appointment.template
/opt/zimbra/jetty-distribution-9.3.5.v20151012/common/lib/zimbracommon.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/templates/calendar/Appointment.template.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup1_2_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/CalendarCore_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup2_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Ajax_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/abook/view/ZmContactSplitView.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/mail/view/ZmMailMsgView.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/mail/controller/ZmMailListController.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/calendar/view/ZmCalDayView.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/calendar/view/ZmCalColView.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/share/view/dialog/ZmFolderDialogTabView.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/zimbraMail/share/model/ZmObjectManager.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/MailCore_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/NewWindow_2_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Contacts_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/TwoFactor_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Calendar_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Ajax_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/NewWindow_2_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Tasks_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup2_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup1_1_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/TwoFactor_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/NewWindow_1_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup1_2_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Calendar_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/ajax/util/AjxStringUtil.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/ajax/util/AjxTimezoneData.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/ajax/dwt/widgets/DwtIframe.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/ajax/dwt/widgets/DwtShell.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/ajax/dwt/graphics/DwtCssStyle.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/DocsPreview_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Tasks_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/DocsPreview_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Startup1_1_all.js.zgz
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/NewWindow_1_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/Contacts_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/MailCore_all.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/js/CalendarCore_all.js
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/proto/index.jsp (from zimbra-store package)
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/hostedlogin.jsp
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/authorize.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/search.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/ImportExport.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Alert.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Leaks.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/NewWindow_1.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/NewWindow_2.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Zimbra.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/UnitTest.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Debug.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/XForms.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Mail.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Briefcase.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/CalendarCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/TasksCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/MailCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Tasks.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/TwoFactor.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Startup2.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Voicemail.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Crypt.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Extras.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/CalendarAppt.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/TinyMCE.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/DocsPreview.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Startup1_2.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/ZimletApp.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Preferences.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/ContactsCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/PreferencesCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Portal.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Share.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Contacts.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Startup1_1.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/BriefcaseCore.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Zimlet.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Docs.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Boot.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/jsp/Calendar.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/extuserprov.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/launchSidebar.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/noscript.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/Offline.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/error.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/access.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/pre-cache.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/Resources.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/insecureResponse.jsp (from zimbra-store package)
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/login.jsp
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/secureRequest.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/loadImgData.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/launchZCS.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/Docs.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/setResourceBundle.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/Boot.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/TwoFactorSetup.jsp (from zimbra-store package)
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/public/launchNewWindow.jsp (from zimbra-store package)
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/lib/zm-taglib-8.7.11.1496138968.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/lib/zm-soap-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/lib/zm-store-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/tags/briefcase/newBriefCheck.tag
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/tags/briefcase/briefcaseListViewToolbar.tag
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/WEB-INF/tags/button.tag
debsums: missing file /opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbra/portals/example/dynamic.jsp (from zimbra-store package)
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/service/WEB-INF/lib/zm-taglib-8.7.11.1496138968.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/service/WEB-INF/lib/zm-soap-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/service/WEB-INF/lib/zm-store-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbraAdmin/js/ajax/util/AjxTimezoneData.js
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbraAdmin/WEB-INF/lib/zm-taglib-8.7.11.1496138968.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbraAdmin/WEB-INF/lib/zm-soap-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/webapps/zimbraAdmin/WEB-INF/lib/zm-store-8.7.11.1496138832.jar
/opt/zimbra/jetty-distribution-9.3.5.v20151012/etc/zimbraAdmin.web.xml.in
/opt/zimbra/jetty-distribution-9.3.5.v20151012/etc/zimbra.web.xml.in