Zoom Patches Multiple Vulnerabilities

guest · Nov 13, 2021

Zoom Patches High-Risk Flaws in Meeting Connector, Keybase Client
November 12, 2021
https://www.securityweek.com/zoom-patches-high-risk-flaws-meeting-connector-keybase-client

The company released multiple security bulletins to warn of the risks and called special attention to a pair of “high-risk” bugs affecting its on-prem meeting connector software and the popular Keybase Client.

“The network proxy page on the web portal for the [affected] products fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator,” Zoom said in a note.
The CVE-2021-34417 carries a CVSS Base Score of 7.9, and affects multiple Zoom software components -- Zoom On-Premise Meeting Connector Controller, Zoom On-Premise Meeting Connector MMR, Zoom On-Premise Recording Connector, Zoom On-Premise Virtual Room Connector.
Click to expand...

A second high-severity bulletin was also released with patches for CVE-2021-34422, a path traversal bug affecting Keybase Client for Windows.
From Zoom’s advisory: [...]

Zoom’s security response team also shipped patches for a medium-risk bug (CVE-2021-34420) in the Zoom Client for Meetings installer.
Click to expand...

The Zoom software does not have an automatic update mechanism. Users are urged to manually check for software updates within the Zoom client.
Click to expand...

guest · Dec 6, 2021

Project Zero Flags High-Risk Zoom Security Flaw
November 29, 2021

The flaws, discovered and reported by Google Project Zero researcher Natalie Silvanovich, affect the company’s flagship Zoom Client for Meetings on all major platforms and could be exploited for code execution attacks.

Zoom slapped a “high-severity” rating on the more serious of the two vulnerabilities (CVE-2021-34423) and warned that the issue also affects a wide range of downstream components and SDKs.

“This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code,” Zoom said in a barebones advisory listing a range of affected products. The bug is described as a buffer overflow with a CVSS base score of 7.3.
Click to expand...

Zoom also fixed a second memory corruption vulnerability (CVE-2021-34424) that allowed for the exposure of the state of process memory in multiple products and components.

“This issue could be used to potentially gain insight into arbitrary areas of the product’s memory,” according to Zoom’s advisory.
Click to expand...

guest · Jan 10, 2023

Zoom Patches High Risk Flaws on Windows, MacOS Platforms
By Ryan Naraine @ryanaraine - January 10, 2023

Video messaging giant Zoom has released patches for multiple security vulnerabilities that expose both Windows and macOS users to malicious hacker attacks.
Click to expand...

The vulnerabilities, in the enterprise-facing Zoom Rooms product, could be exploited in privilege escalation attacks on both Windows and macOS platforms.

The company’s first batch of patches for 2023 includes patches for a trio of “high-severity” vulnerabilities in Zoom Room for Windows Installers, Zoom Room for Windows Clients and Zoom Rooms for macOS Clients.
Click to expand...

Here’s how Zoom is documenting the high-risk issues:

CVE-2022-36930 -- Local Privilege Escalation in Zoom Rooms for Windows Installers (CVSS 8.2/10) -- Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability.

CVE-2022-36929 - Local Privilege Escalation in Zoom Rooms for Windows Clients (CVSS 7.8/10) --Zoom Rooms for Windows clients before version 5.12.7 contain a local privilege escalation vulnerability.

CVE-2022-36927 -- Local Privilege Escalation in Zoom Rooms for macOS Clients (CVSS 8.8/10) -- Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability.

Click to expand...

Zoom also released fixes for a pair of medium-severity bugs in Zoom Rooms for macOS clients before version 5.11.4, warning that this version of the software contains an insecure key generation mechanism.

“The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service,”
according to Zoom’s documentation.
Zoom also fixed a path traversal vulnerability in Zoom for Android Clients, warning that a third party app could exploit this vulnerability to read and write to the Zoom application data directory.
Click to expand...

Log in or Sign up

Zoom Patches Multiple Vulnerabilities

guest Guest

guest Guest

guest Guest

Log in or Sign up

Zoom Patches Multiple Vulnerabilities

guest Guest

guest Guest

guest Guest

Useful Searches