PT-2023-13509 · Zoom · Zoom Rooms For Macos

Published 2023-01-09 · Updated 2023-01-13 · CVE-2022-36925

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Rooms for macOS versions prior to 5.11.4

Description The issue concerns an insecure key generation mechanism in Zoom Rooms for macOS. Specifically, the encryption key used for Inter-Process Communication (IPC) between the Zoom Rooms daemon service and the client can be generated using parameters obtainable by a local low-privileged application. This key can then be utilized to interact with the daemon service, allowing the execution of privileged functions and potentially causing a local denial of service.

Recommendations For versions prior to 5.11.4, update to version 5.11.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Zoom Rooms daemon service to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2022-36925

Affected Products

Zoom Rooms For Macos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36925 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36925 · Vendor Advisory
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://t.me/nekaspersky/2738 · Telegram Post
• https://t.me/cibsecurity/56171 · Telegram Post