Zoom informed customers last week that macOS updates for the Zoom application patch two high-severity vulnerabilities. Details of the flaws were disclosed on Friday at the DEF CON conference in Las Vegas by macOS security researcher Patrick Wardle.
Wardle, who is the founder of the Objective-See Foundation, a non-profit that provides free and open source macOS security resources, showed at DEF CON how a local, unprivileged attacker could exploit vulnerabilities in Zoom’s update process to escalate privileges to root.
The researcher showed in his presentation that the macOS user is not prompted for their admin password when Zoom is updated, including when it’s automatically updated — the auto-update feature is enabled by default. He also showed how a malicious actor could hijack the update mechanism to downgrade Zoom to an older version that can contain known vulnerabilities.
Many researchers have found critical vulnerabilities in Zoom since the pandemic led to a wide adoption of the video conferencing platform. Google researchers, for instance, recently detailed a zero-click remote code execution exploit.
The attack described at DEF CON by Wardle involved a local attacker abusing the auto-update process, which can be initiated on demand, and leveraging a cryptographic flaw related to insecure update package signature validation — update packages can only be installed if they are signed by Zoom.
Zoom patched some related vulnerabilities in the past months, but Wardle said during his talk that his attack had still worked. One day after the presentation, however, Zoom announced the release of Zoom Client for Meetings for macOS 5.11.5 to patch the auto-update process vulnerability (CVE-2022-28756). Version 5.11.3, which should patch the packet signature validation issue (CVE-2022-28751), was announced on August 9, a few days before the DEF CON presentation.
The company pointed out that both the standard and IT admin versions of the application are affected.
Zoom has also informed customers about five other critical and high-severity vulnerabilities, including ones that could lead to remote code execution, privilege escalation, and the hijacking and disruption of meetings. Most of these flaws were discovered by Zoom’s own security team.
Also last week, at the Black Hat conference in Las Vegas, Wardle revealed that some commercial cybersecurity products had stolen algorithms from one of the free tools offered by his Objective-See Foundation.
Related: Zoom Patches Two Serious Vulnerabilities Found by Cisco Researchers
Related: Project Zero: Zoom Platform Missed ASLR Exploit Mitigation
Related: Details Disclosed for Zoom Exploit That Earned Researchers $200,000
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- CISA, NSA Issue Guidance for IAM Administrators
- Analysis: SEC Cybersecurity Proposals and Biden’s National Cybersecurity Strategy
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- Tackling the Challenge of Actionable Intelligence Through Context
- Dole Says Employee Information Compromised in Ransomware Attack
- Backslash Snags $8M Seed Financing for AppSec Tech
