PT-2022-19208 · Zoom · Zoom On-Premise Meeting Connector Controller

Published 2022-08-11 · Updated 2022-08-18 · CVE-2022-28750

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom On-Premise Meeting Connector Zone Controller (ZC) versions prior to 4.8.20220419.112

Description The issue arises from the improper parsing of STUN error codes, leading to potential memory corruption. This could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, it could also be exploited to execute arbitrary code.

Recommendations For versions prior to 4.8.20220419.112, update to version 4.8.20220419.112 or later to resolve the issue. For versions older than 4.8.12.20211115, updating to a version 4.8.12.20211115 or later is also crucial to prevent arbitrary code execution.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2022-28750

Affected Products

Zoom On-Premise Meeting Connector Controller

References · 3

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28750 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28750 · Vendor Advisory