ZIMBRA: Offline Patch Curl Zimbra 8.0.7

by M. Anwar Friday, November 21, 2014 0 comments windows categories zimbra

First download the appropriate binaries from this location:

RHEL/CentOS 6: http://files.zimbra.com/downloads/8.0.7_GA/curl/RHEL6_64/curl-7.35.0.tgz
UBUNTU 10: http://files.zimbra.com/downloads/8.0.7_GA/curl/UBUNTU10_64/curl-7.35.0.tgz
UBUNTU 12: http://files.zimbra.com/downloads/8.0.7_GA/curl/UBUNTU12_64/curl-7.35.0.tgz
SLES 11: http://files.zimbra.com/downloads/8.0.7_GA/curl/SLES11_64/curl-7.35.0.tgz

The MD5 checksums are also available:

RHEL/CentOS 6: http://files.zimbra.com/downloads/8.0.7_GA/curl/RHEL6_64/curl-7.35.0.tgz.md5sum
UBUNTU 10: http://files.zimbra.com/downloads/8.0.7_GA/curl/UBUNTU10_64/curl-7.35.0.tgz.md5sum
UBUNTU 12: http://files.zimbra.com/downloads/8.0.7_GA/curl/UBUNTU12_64/curl-7.35.0.tgz.md5sum
SLES 11: http://files.zimbra.com/downloads/8.0.7_GA/curl/SLES11_64/curl-7.35.0.tgz.md5sum

Then place the downloaded tgz file at the following location: /tmp/curl/$PLAT/
(where $PLAT is one of RHEL6_64, SLES11_64, UBUNTU10_64, or UBUNTU12_64).

Then run:
[root@mail01 ~]# ./zmcurl807-updater.sh -o

Validating patched curl: success
Backing up old curl: complete
Installing patched curl: complete
Curl patch process complete.
Please restart Zimbra Collaboration Suite as the Zimbra user via 

--------------------------------------------------
restart service mta
--------------------------------------------------
[root@mail01 zimbra]# su - zimbra
[zimbra@mail01 ~]$ zmmtactl stop
/postfix-script: stopping the Postfix mail system
Stopping saslauthd...done.
[zimbra@mail01 ~]$ zmmtactl start
Rewriting configuration files...done.
Starting saslauthd...done.
/postfix-script: starting the Postfix mail system

-----------------------

check with this command

-----------------------

[root@mail01 ]# curl https://shellshocker.net/shellshock_test.sh | bash

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

  Dload  Upload   Total   Spent    Left  Speed

101  2627  101  2627    0     0    416      0  0:00:06  0:00:06 --:--:--  1957

CVE-2014-6271 (original shellshock): not vulnerable

CVE-2014-6277 (segfault): not vulnerable

CVE-2014-6278 (Florian's patch): not vulnerable

CVE-2014-7169 (taviso bug): not vulnerable

CVE-2014-7186 (redir_stack bug): not vulnerable

CVE-2014-7187 (nested loops off by one): not vulnerable

CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable