PT-2023-12110 · Zscaler · Zscaler Client Connector

Thomas Chauchefoin · Published 2023-10-23 · Updated 2023-10-27 · CVE-2021-26737

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector for macOS versions prior to 3.6

Description The Zscaler Client Connector for macOS did not sufficiently validate RPC clients, allowing a local adversary without sufficient privileges to potentially shutdown the Zscaler tunnel by exploiting a race condition.

Recommendations For versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the RPC client validation mechanism to minimize the risk of exploitation.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2021-26737

Affected Products

Zscaler Client Connector

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-26737 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26737 · Vendor Advisory
• https://twitter.com/DMFezzaReedCISA/status/1716488467721474491 · Twitter Post
• https://t.me/cibsecurity/72766 · Telegram Post
• https://twitter.com/CVEnew/status/1716448946501898615 · Twitter Post
• https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.6&deployment_date=2022-01-07&id=1388686 · Note