PT-2021-5207 · Zoom · Zoom Vdi Vmware Plugins+20

Natalie Silvanovich · Published 2021-11-24 · Updated 2022-07-12 · CVE-2021-34424

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings versions prior to 5.8.4 Zoom Client for Meetings for Blackberry versions prior to 5.8.1 Zoom Client for Meetings for intune versions prior to 5.8.4 Zoom Client for Meetings for Chrome OS versions prior to 5.0.1 Zoom Rooms for Conference Room versions prior to 5.8.3 Controllers for Zoom Rooms versions prior to 5.8.3 Zoom VDI Windows Meeting Client versions prior to 5.8.4 Zoom VDI Azure Virtual Desktop Plugins versions prior to 5.8.4.21112 Zoom VDI Citrix Plugins versions prior to 5.8.4.21112 Zoom VDI VMware Plugins versions prior to 5.8.4.21112 Zoom Meeting SDK for Android versions prior to 5.7.6.1922 Zoom Meeting SDK for iOS versions prior to 5.7.6.1082 Zoom Meeting SDK for macOS versions prior to 5.7.6.1340 Zoom Meeting SDK for Windows versions prior to 5.7.6.1081 Zoom Video SDK versions prior to 1.1.2 Zoom on-premise Meeting Connector versions prior to 4.8.12.20211115 Zoom on-premise Meeting Connector MMR versions prior to 4.8.12.20211115 Zoom on-premise Recording Connector versions prior to 5.1.0.65.20211116 Zoom on-premise Virtual Room Connector versions prior to 4.4.7266.20211117 Zoom on-premise Virtual Room Connector Load Balancer versions prior to 2.5.5692.20211117 Zoom Hybrid Zproxy versions prior to 1.0.1058.20211116 Zoom Hybrid MMR versions prior to 4.6.20211116.131 x86-64

Description The issue is related to the exposure of the state of process memory, potentially allowing an attacker to gain insight into arbitrary areas of the product's memory. This could be used to potentially expose protected information.

Recommendations Update Zoom Client for Meetings to version 5.8.4 or later. Update Zoom Client for Meetings for Blackberry to version 5.8.1 or later. Update Zoom Client for Meetings for intune to version 5.8.4 or later. Update Zoom Client for Meetings for Chrome OS to version 5.0.1 or later. Update Zoom Rooms for Conference Room to version 5.8.3 or later. Update Controllers for Zoom Rooms to version 5.8.3 or later. Update Zoom VDI Windows Meeting Client to version 5.8.4 or later. Update Zoom VDI Azure Virtual Desktop Plugins to version 5.8.4.21112 or later. Update Zoom VDI Citrix Plugins to version 5.8.4.21112 or later. Update Zoom VDI VMware Plugins to version 5.8.4.21112 or later. Update Zoom Meeting SDK for Android to version 5.7.6.1922 or later. Update Zoom Meeting SDK for iOS to version 5.7.6.1082 or later. Update Zoom Meeting SDK for macOS to version 5.7.6.1340 or later. Update Zoom Meeting SDK for Windows to version 5.7.6.1081 or later. Update Zoom Video SDK to version 1.1.2 or later. Update Zoom on-premise Meeting Connector to version 4.8.12.20211115 or later. Update Zoom on-premise Meeting Connector MMR to version 4.8.12.20211115 or later. Update Zoom on-premise Recording Connector to version 5.1.0.65.20211116 or later. Update Zoom on-premise Virtual Room Connector to version 4.4.7266.20211117 or later. Update Zoom on-premise Virtual Room Connector Load Balancer to version 2.5.5692.20211117 or later. Update Zoom Hybrid Zproxy to version 1.0.1058.20211116 or later. Update Zoom Hybrid MMR to version 4.6.20211116.131 x86-64 or later.

Fix

Out of bounds Read

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-125

CWE-668

Related Identifiers

BDU:2021-06009

CVE-2021-34424

Affected Products

Zoom Rooms Controllers

Zoom Client For Meetings

Zoom Client For Meetings For Blackberry

Zoom Client For Meetings For Chrome Os

Zoom Client For Meetings For Intune

Zoom Hybrid Mmr

Zoom Hybrid Zproxy

Zoom Meeting Sdk For Android

Zoom Meeting Sdk For Windows

Zoom Meeting Sdk For Ios

Zoom Rooms For Conference Room

Zoom Vdi Azure Virtual Desktop Plugins

Zoom Vdi Citrix Plugins

Zoom Vdi Vmware Plugins

Zoom Vdi Windows Meeting Clients

Zoom Video Sdk

Zoom On-Premise Meeting Connector Mmr

Zoom On-Premise Recording Connector

Zoom On-Premise Virtual Room Connector

Zoom On-Premise Virtual Room Connector Load Balancer

Zoom

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-34424 · Security Note
• https://bdu.fstec.ru/vul/2021-06009 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34424 · Vendor Advisory
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/32966 · Telegram Post
• http://packetstormsecurity.com/files/165419/Zoom-MMR-Server-Information-Leak.html · Note
• https://t.me/true_secator/2389 · Telegram Post
• https://t.me/cvenotify/24085 · Telegram Post