Authentication Bypass in MailboxImportServlet vulnerability (reminder)
https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/

Fixed-NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider after upgrade to 8.8.15_GA_4304

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Edx2Eu7
Posts: 11
Joined: Tue Jun 21, 2022 7:57 pm

Fixed-NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider after upgrade to 8.8.15_GA_4304

Postby Edx2Eu7 » Thu Jun 23, 2022 5:55 am

Hi there,

after upgrading to version 8.8.15_GA_4304 any interaction with the calendar fails with the following message

Code: Select all

A network service error has occurred.
method:   [unknown]
msg:   system failure: java.lang.NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider
code:   service.FAILURE
detail:   soap:Receiver
trace:   qtp364604394-242:1655963565695:48491be25bc19728


Full version info

Code: Select all

Release 8.8.15.GA.4179.UBUNTU20.64 UBUNTU20_64 FOSS edition, Patch 8.8.15_P32


Any suggestion highly welcome.

Thanks in advacne and best regards
Edx2Eu7
Last edited by Edx2Eu7 on Sun Jun 26, 2022 8:38 am, edited 1 time in total.


Edx2Eu7
Posts: 11
Joined: Tue Jun 21, 2022 7:57 pm

Re: NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider after upgrade to 8.8.15_GA_4304

Postby Edx2Eu7 » Thu Jun 23, 2022 7:41 am

class file still available within the installed libraries

Code: Select all

grep -rli "com.zimbra.cs.fb.FreeBusyProvider.class" /opt/zimbra/lib/

/opt/zimbra/lib/jars/zimbrastore.jar
Edx2Eu7
Posts: 11
Joined: Tue Jun 21, 2022 7:57 pm

Re: NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider after upgrade to 8.8.15_GA_4304

Postby Edx2Eu7 » Thu Jun 23, 2022 5:45 pm

More traces found in file

Code: Select all

/opt/zimbra/log/zmmailboxd.out


Stacktrace logged

Code: Select all

WARNING: Initial attempt to create application context was unsuccessful.
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'cxf' defined in class path resource [META-INF/cxf/cxf.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apache.cxf.bus.spring.SpringBus]: Constructor threw exception; nested exception is org.apache.cxf.bus.extension.ExtensionException: Could not load extension class org.apache.cxf.common.util.ASMHelperImpl.
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1303)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1197)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:555)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:515)
        at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:320)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:318)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:847)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:877)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:549)
        at org.apache.cxf.bus.spring.BusApplicationContext$1.run(BusApplicationContext.java:107)
        at org.apache.cxf.bus.spring.BusApplicationContext$1.run(BusApplicationContext.java:105)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:569)
        at org.apache.cxf.bus.spring.BusApplicationContext.<init>(BusApplicationContext.java:105)
        at org.apache.cxf.bus.spring.SpringBusFactory.createApplicationContext(SpringBusFactory.java:157)
        at org.apache.cxf.bus.spring.SpringBusFactory.createBus(SpringBusFactory.java:148)
        at org.apache.cxf.bus.spring.SpringBusFactory.createBus(SpringBusFactory.java:122)
        at org.apache.cxf.bus.spring.SpringBusFactory.createBus(SpringBusFactory.java:94)
        at org.apache.cxf.bus.spring.SpringBusFactory.createBus(SpringBusFactory.java:83)
        at org.apache.cxf.BusFactory.getDefaultBus(BusFactory.java:107)
        at org.apache.cxf.BusFactory.createThreadBus(BusFactory.java:243)
        at org.apache.cxf.BusFactory.getThreadDefaultBus(BusFactory.java:227)
        at org.apache.cxf.jaxws.ServiceImpl.initialize(ServiceImpl.java:134)
        at org.apache.cxf.jaxws.ServiceImpl.<init>(ServiceImpl.java:128)
        at org.apache.cxf.jaxws.spi.ProviderImpl.createServiceDelegate(ProviderImpl.java:82)
        at javax.xml.ws.Service.<init>(Service.java:112)
        at com.microsoft.schemas.exchange.services._2006.messages.ExchangeService.<init>(Unknown Source)
        at com.zimbra.cs.fb.ExchangeEWSFreeBusyProvider.<clinit>(ExchangeEWSFreeBusyProvider.java:155)
        at com.zimbra.cs.fb.FreeBusyProvider.<clinit>(FreeBusyProvider.java:321)
        at com.zimbra.cs.fb.FreeBusyProvider$Listener.notify(FreeBusyProvider.java:57)
        at com.zimbra.cs.mailbox.MailboxListener.notifyListeners(MailboxListener.java:124)
        at com.zimbra.cs.mailbox.Mailbox.commitCache(Mailbox.java:10110)
        at com.zimbra.cs.mailbox.Mailbox.endTransaction(Mailbox.java:9819)
        at com.zimbra.cs.mailbox.Mailbox.snoozeCalendarItemAlarm(Mailbox.java:5279)
        at com.zimbra.cs.service.mail.SnoozeCalendarItemAlarm.handle(SnoozeCalendarItemAlarm.java:80)
        at com.zimbra.soap.SoapEngine.dispatchRequest(SoapEngine.java:646)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:491)
        at com.zimbra.soap.SoapEngine.dispatch(SoapEngine.java:278)
        at com.zimbra.soap.SoapServlet.doWork(SoapServlet.java:308)
        at com.zimbra.soap.SoapServlet.doPost(SoapServlet.java:217)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at com.zimbra.cs.servlet.ZimbraServlet.service(ZimbraServlet.java:214)


as well as

Code: Select all

Caused by: java.lang.IncompatibleClassChangeError: class org.apache.cxf.common.util.ASMHelperImpl can not implement org.apache.cxf.common.util.ASMHelper, because it is not an interface (org.apache.cxf.common.util.ASMHelper is in unnamed module of loader org.eclipse.jetty.webapp.WebAppClassLoader @24f360b2
        at java.base/java.lang.ClassLoader.defineClass1(Native Method)
        at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1012)
        at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:150)
        at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:524)
        at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:427)
        at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:421)
        at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
        at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:420)
        at org.eclipse.jetty.webapp.WebAppClassLoader.foundClass(WebAppClassLoader.java:642)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadAsResource(WebAppClassLoader.java:615)
        at org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:529)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520)
        at org.apache.cxf.bus.extension.Extension.tryClass(Extension.java:164)
        ... 128 more


Best regards
Ed
Edx2Eu7
Posts: 11
Joined: Tue Jun 21, 2022 7:57 pm

Re: NoClassDefFoundError: Could not initialize class com.zimbra.cs.fb.FreeBusyProvider after upgrade to 8.8.15_GA_4304

Postby Edx2Eu7 » Sun Jun 26, 2022 8:33 am

Had time to look at this again today and found the issue. Patch installation upgraded Apache CXF components but left all old libraries lying around. Fixed by moving the old cxf*3.3.4 libraries and restarting the services.

Code: Select all

find /opt/zimbra/ -iname "*cxf*"
./lib/jars/cxf-core-3.5.1.jar
./lib/jars/cxf-core-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/classes/cxf.xml
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-frontend-simple-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-transports-http-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-frontend-jaxws-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-wsdl-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-core-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-frontend-simple-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-databinding-jaxb-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-databinding-jaxb-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-wsdl-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-bindings-soap-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-transports-http-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-core-3.5.1.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-frontend-jaxws-3.3.4.jar
./jetty_base/webapps/service/WEB-INF/lib/cxf-rt-bindings-soap-3.5.1.jar

find /opt/zimbra/ -iname "*cxf*3.3.4*" -print0 | xargs -0 -r -I {} mv {} /root/2020_06_26_Zimbra_cxf_3_3_4_backup/

su - zimbra -c "zmcontrol restart"


As there also had been some posts regarding the Java mailboxd options that are to be applied after patching, the following options are the one's that I'm currently using successfully

Code: Select all

mailboxd_java_options = -server -Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols=TLSv1.2 -Djava.awt.headless=true -Dsun.net.inetaddr.ttl= -Dorg.apache.jasper.compiler.disablejsr199=true -XX:+UseG1GC -XX:SoftRefLRUPolicyMSPerMB=1 -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=15 -XX:G1MaxNewSizePercent=45 -XX:-OmitStackTraceInFastThrow -verbose:gc -Xlog:gc*=info,safepoint=info:file=/opt/zimbra/log/gc.log:time:filecount=20,filesize=10m -Djava.security.egd=file:/dev/./urandom --add-opens java.base/java.lang=ALL-UNNAMED -Djava.net.preferIPv4Stack=true


Best regards
Ed

Return to “Administrators”

Who is online

Users browsing this forum: Majestic-12 [Bot] and 33 guests