Lucene search

ZoomCVE-2021-34409

HistorySep 27, 2021 - 2:15 p.m.

CVE-2021-34409

2021-09-2714:15:08

CWE-732

Zoom

web.nvd.nist.gov

cve-2021-34409

zoom

macos

iphone

ipad

installation

vulnerability

security

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.6%

JSON

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user’s machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.

Affected configurations

Nvd

Node

zoommeetingsRange<5.2.0macos

zoomroomsRange<5.1.0

zoomscreen_sharingRange<5.2.0ipados

zoomscreen_sharingRange<5.2.0iphone_os

VendorProductVersionCPE
zoommeetings*cpe:2.3:a:zoom:meetings:*:*:*:*:*:macos:*:*
zoomrooms*cpe:2.3:a:zoom:rooms:*:*:*:*:*:*:*:*
zoomscreen_sharing*cpe:2.3:a:zoom:screen_sharing:*:*:*:*:*:ipados:*:*
zoomscreen_sharing*cpe:2.3:a:zoom:screen_sharing:*:*:*:*:*:iphone_os:*:*

Vendor	Product	Version	CPE
zoom	meetings	*	cpe:2.3:a:zoom:meetings::::::macos::*
zoom	rooms	*	cpe:2.3:a:zoom:rooms::::::::
zoom	screen_sharing	*	cpe:2.3:a:zoom:screen_sharing::::::ipados::*
zoom	screen_sharing	*	cpe:2.3:a:zoom:screen_sharing::::::iphone_os::*

CNA Affected

[
  {
    "product": "Zoom Client for Meetings for MacOS (Standard and for IT Admin)",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.2.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Client Plugin for Sharing iPhone/iPad",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.2.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Rooms for Conference",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2021-34409