Zoom fixed 2 flaws in macOS App that were disclosed at DEF CON
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-28750 | Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corr Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code. NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2022-28751 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2022-28752 | Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2022-28755 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths. NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2022-28756 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update pro The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article443 words · extracted from securityaffairs.com · click to collapse
Zoom addressed two high-severity vulnerabilities in its macOS app that were disclosed at the DEF CON conference.
Zoom last week released macOS updates to fix two high-severity flaws in its macOS app that were disclosed at the DEF CON conference. Technical details of the vulnerabilities were disclosed at the DEF CON conference by security researcher Patrick Wardle during its talk “You’re M̶u̶t̶e̶d̶ Rooted.”
In his talk, the expert explored Zoom’s macOS application to uncover several critical security flaws that can be exploited by a local unprivileged attacker to achieve root access to the device.
Wardle demonstrated that an attacker could hijack the update mechanism to downgrade the software to an older version that is known to be affected by vulnerabilities.
The experts pointed out that macOS users are not prompted for their admin password when Zoom is updated, because the auto-update feature is enabled by default.
Zoom informed customers last week that macOS updates for the Zoom application patch two high-severity vulnerabilities. Details of the flaws were disclosed on Friday at the DEF CON conference in Las Vegas by macOS security researcher Patrick Wardle.
Wardle, who is the founder of the Objective-See Foundation, a non-profit that provides free and open source macOS security resources, showed at DEF CON how a local, unprivileged attacker could exploit vulnerabilities in Zoom’s update process to escalate privileges to root.
“In this talk, we’ll explore Zoom’s macOS application to uncover several critical security flaws. Flaws, that provided a local unprivileged attacker a direct and reliable path to root.” Wardle explained. The first flaw, presents itself subtly in a core cryptographic validation routine, while the second is due to a nuanced trust issue between Zoom’s client and its privileged helper component.”
Wardle demonstrated that a local attacker abusing the auto-update process and leveraging a cryptographic issue related to insecure update package signature validation can install an update package.
Zoom addressed some related vulnerabilities in the past months, but Wardle explained that he was still able to exploit them in his attack. The day after the talk, the company released Client for Meetings for macOS 5.11.5 that fix the auto-update process vulnerability (CVE-2022-28756). The company also announced Version 5.11.3 which addresses the packet signature validation issue (CVE-2022-28751).
Zoom also addressed other critical and high-severity vulnerabilities:
- CVE-2022-28753, CVE-2022-28754: Zoom On-Premise Deployments: Improper Access Control Vulnerability (HIGH)
- CVE-2022-28755: Improper URL parsing in Zoom Clients (CRITICAL)
- CVE-2022-28752: Local Privilege Escalation in the Zoom Rooms for Windows Client (HIGH)
- CVE-2022-28750: Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector (HIGH)
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, macOS)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/134468/security/zoom-macos-app-flaws.html