Multiple Vulnerabilities in Zoom Products

Multiple vulnerabilities have been identified in Zoom products. An attacker could exploit these vulnerabilities to gain escalated privileges, bypass security restrictions, disclose sensitive information, delete local files without proper permissions, and perform denial of service (DoS) attacks on the targeted system. Advisory from CERT-IN.

These Vulnerabilities exist in zoom products due to improper validation of user supplied input, insufficient verification of data authenticity, improper privilege management, improper access control, buffer copy without checking size of input, and exposure of resource to wrong sphere. An attacker could exploit these vulnerabilities by sending specially crafted request.

Software Affected (Severity Rating)

Zoom Meeting SDK before 5.13.0

Zoom for Windows before version 5.14.10

Zoom for MacOS before version 5.14.10

Zoom for Windows clients before version 5.14.0

Zoom for MacOS clients before version 5.14.0

Zoom for Linux clients before version 5.13.10

Zoom Rooms client for Windows before version 5.14.0

Zoom VDI Windows Meeting clients before version 5.14.0

Zoom VDI Windows Meeting installer before version 5.14.0

Zoom for Android, IOS, Linux, macOS, and Windows clients before version 5.13.10

Successful exploitation of these vulnerabilities allows an attacker to gain escalated privileges, bypass security restrictions, disclose sensitive information, delete local files without proper permissions, and perform denial of service (DoS) attacks on the targeted system.