PT-2019-13427 · Zoom · Zoom Client

Vakzz · Published 2019-07-12 · Updated 2020-08-24 · CVE-2019-13567

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client versions prior to 4.4.53932.0709

Description The issue allows remote code execution if the ZoomOpener daemon is running but the Zoom Client is not installed or cannot be opened. An attacker can exploit this by using a maliciously crafted launch URL. The ZoomOpener daemon can be removed by the Apple Malware Removal Tool (MRT) if it is enabled and has the 2019-07-10 MRTConfigData.

Recommendations For Zoom Client versions prior to 4.4.53932.0709, update to version 4.4.53932.0709 or later to resolve the issue. As a temporary workaround, consider disabling the ZoomOpener daemon until a patch is available. Restrict access to any launch URLs that could potentially exploit the vulnerability to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-13567

Affected Products

Zoom Client

References · 10

• 🔥 https://twitter.com/wcbowling/status/1149457231504498689 · Exploit
• https://osv.dev/vulnerability/CVE-2019-13567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13567 · Security Note
• https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS · Vendor Advisory
• https://twitter.com/wcbowling/status/1166998107667619841 · Note
• https://twitter.com/riskybusiness/status/1149125147019767814 · Note
• https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b · Note
• https://t.me/thehackernews/380 · Telegram Post
• https://twitter.com/JLLeitschuh/status/1149422543658520578 · Note
• https://twitter.com/JLLeitschuh/status/1149420685405708295 · Note