Vulnerability Disclosure: Unpatched Information Leak and Denial of Service in Zoom
|by Alpha Team
Two vulnerabilities in the Zoom meeting client on macOS were disclosed Monday. Zoom has only released a patch for one of the two - a denial of service condition, while the second, an information leak where an attacker may enable a webcamera without a user's knowledge or acknowledgement, remains unpatched. These vulnerabilities are due to a "feature" where the Zoom client automatically opens meeting links on any page in a web browser, without user interaction.
Recommendations
- Update the Zoom client on macOS to version 4.4.2 to avoid a potential denial of service.
- Consider using a web camera cover on any device with a web camera in order to avoid unauthorized use and potential information leak.
Details
Several security issues in the video conferencing software Zoom were announced Monday. Both vulnerabilities are within the Zoom client on macOS. An unpatched information disclosure (CVE-2019-34590) allows users to be lauched into a Zoom call, web camera enabled, with no user interaction. Additionally, an attacker may trigger a denial of service by launching a user into an invalid call (CVE-2019-13449). In addition to these two vulnerabilities, any user who has ever installed the Zoom client, regardless of whether or not they have uninstalled the client, has a Zoom web server on their machine. This means that a user who has uninstalled the client, can unknowingly have Zoom forcibly re-installed on their machine with no user interaction required other than visting a web page.
These vulnerabilities arise because of a feature in Zoom that automatically opens any Zoom meeting link on a web page, within the Zoom client. This means that regardless of whether a user has clicked on a meeting link, an attacker may be able to embed meeting links within webpages in order to trigger a denial or service or turn on a webcamera without the user's knowledge.
Although Zoom has since patched the denial of service, the web camera information disclosure is yet unpatched.
Tags: all industries, global, vulnerability/exploit