PT-2023-12110 · Zscaler · Zscaler Client Connector

Thomas Chauchefoin · Publicado 2023-10-23 · Atualizado 2023-10-27 · CVE-2021-26737

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector for macOS versions prior to 3.6

Description The Zscaler Client Connector for macOS did not sufficiently validate RPC clients, allowing a local adversary without sufficient privileges to potentially shutdown the Zscaler tunnel by exploiting a race condition.

Recommendations For versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPC client validation mechanism to minimize the risk of exploitation.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2021-26737

Produtos afetados

Zscaler Client Connector

Referências · 6

• https://twitter.com/DMFezzaReedCISA/status/1716488467721474491 · Publicação no Twitter
• https://t.me/cibsecurity/72766 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1716448946501898615 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-26737 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2021-26737 · Aviso do Fabricante
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.6&deployment_date=2022-01-07&id=1388686 · Nota