7.5

CVE-2021-34424

Process memory exposure in Zoom Client and other products

A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom on-premise Meeting Connector before version 4.8.12.20211115, Zoom on-premise Meeting Connector MMR before version 4.8.12.20211115, Zoom on-premise Recording Connector before version 5.1.0.65.20211116, Zoom on-premise Virtual Room Connector before version 4.4.7266.20211117, Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64 which potentially allowed for the exposure of the state of process memory. This issue could be used to potentially gain insight into arbitrary areas of the product's memory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zoom ≫ Meetings Version < 5.8.3
   Google ≫ Android Version -
Zoom ≫ Meetings Version < 5.8.4
   Apple ≫ macOS Version -
Zoom ≫ Meetings Version < 5.8.4
   Apple ≫ iPhone OS Version -
Zoom ≫ Meetings Version < 5.8.4
   Linux ≫ Linux Kernel Version -
Zoom ≫ Meetings Version < 5.8.4
   Microsoft ≫ Windows Version -
Zoom ≫ Meetings For Blackberry Version < 5.8.1
   Google ≫ Android Version -
Zoom ≫ Meetings For Blackberry Version < 5.8.1
   Apple ≫ iPhone OS Version -
Zoom ≫ Meetings For Intune Version < 5.8.4
   Apple ≫ iPhone OS Version -
Zoom ≫ Meetings For Intune Version < 5.8.4
   Google ≫ Android Version -
Zoom ≫ Meetings For Chrome Os Version < 5.0.1
Zoom ≫ Rooms For Conference Rooms Version < 5.8.3
   Google ≫ Android Version -
Zoom ≫ Rooms For Conference Rooms Version < 5.8.3
   Apple ≫ macOS Version -
Zoom ≫ Rooms For Conference Rooms Version < 5.8.3
   Microsoft ≫ Windows Version -
Zoom ≫ Controllers For Zoom Rooms Version < 5.8.3
   Microsoft ≫ Windows Version -
Zoom ≫ Controllers For Zoom Rooms Version < 5.8.3
   Apple ≫ iPhone OS Version -
Zoom ≫ Controllers For Zoom Rooms Version < 5.8.3
   Google ≫ Android Version -
Zoom ≫ Android Meeting Sdk Version < 5.7.6.1922
Zoom ≫ Iphone Os Meeting Sdk Version < 5.7.6.1082
Zoom ≫ Macos Meeting Sdk Version < 5.7.6.1340
Zoom ≫ Windows Meeting Sdk Version < 5.7.6.1081
Zoom ≫ Android Video Sdk Version < 1.1.2
Zoom ≫ Iphone Os Video Sdk Version < 1.1.2
Zoom ≫ Macos Video Sdk Version < 1.1.2
Zoom ≫ Windows Video Sdk Version < 1.1.2
Zoom ≫ Hybrid Mmr Version < 4.6.20211116.131
Zoom ≫ Hybrid Zproxy Version < 1.0.1058.20211116
Zoom ≫ Zoom On-premise Meeting Connector Controller Version < 4.8.12.20211115
Zoom ≫ Zoom On-premise Meeting Connector Mmr Version < 4.8.12.20211115
Zoom ≫ Zoom On-premise Recording Connector Version < 5.1.0.65.20211116
Zoom ≫ Zoom On-premise Virtual Room Connector Version < 4.4.7266.20211117
Zoom ≫ Vdi Azure Virtual Desktop Version < 5.8.4.21112
Zoom ≫ Vdi Citrix Version < 5.8.4.21112
Zoom ≫ Vdi Vmware Version < 5.8.4.21112
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.67% 0.737
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
security@zoom.us 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

https://explore.zoom.us/en/trust/security/security-bulletin
Vendor Advisory
http://packetstormsecurity.com/files/165419/Zoom-MMR-Server-Information-Leak.html
Third Party Advisory
VDB Entry