Zoom informed customers last week that macOS updates for the Zoom application patch two high-severity vulnerabilities. Details of the flaws were disclosed on Friday at the DEF CON conference in Las Vegas by macOS security researcher Patrick Wardle.
Wardle, who is the founder of the Objective-See Foundation, a non-profit that provides free and open source macOS security resources, showed at DEF CON how a local, unprivileged attacker could exploit vulnerabilities in Zoom’s update process to escalate privileges to root.
The researcher showed in his presentation that the macOS user is not prompted for their admin password when Zoom is updated, including when it’s automatically updated — the auto-update feature is enabled by default. He also showed how a malicious actor could hijack the update mechanism to downgrade Zoom to an older version that can contain known vulnerabilities.
Many researchers have found critical vulnerabilities in Zoom since the pandemic led to a wide adoption of the video conferencing platform. Google researchers, for instance, recently detailed a zero-click remote code execution exploit.
The attack described at DEF CON by Wardle involved a local attacker abusing the auto-update process, which can be initiated on demand, and leveraging a cryptographic flaw related to insecure update package signature validation — update packages can only be installed if they are signed by Zoom.
Zoom patched some related vulnerabilities in the past months, but Wardle said during his talk that his attack had still worked. One day after the presentation, however, Zoom announced the release of Zoom Client for Meetings for macOS 5.11.5 to patch the auto-update process vulnerability (CVE-2022-28756). Version 5.11.3, which should patch the packet signature validation issue (CVE-2022-28751), was announced on August 9, a few days before the DEF CON presentation.
The company pointed out that both the standard and IT admin versions of the application are affected.
Zoom has also informed customers about five other critical and high-severity vulnerabilities, including ones that could lead to remote code execution, privilege escalation, and the hijacking and disruption of meetings. Most of these flaws were discovered by Zoom’s own security team.
Also last week, at the Black Hat conference in Las Vegas, Wardle revealed that some commercial cybersecurity products had stolen algorithms from one of the free tools offered by his Objective-See Foundation.
Related: Zoom Patches Two Serious Vulnerabilities Found by Cisco Researchers
Related: Project Zero: Zoom Platform Missed ASLR Exploit Mitigation
Related: Details Disclosed for Zoom Exploit That Earned Researchers $200,000