A zero-day vulnerability in Zoom could potentially lead to a remote code execution attack. Here’s what you need to know.

Unauthorized Call and Webcam Access Vulnerability in Zoom Mac Client (CVE-2019-13450)

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.

The version of Zoom Client for Meetings installed on the remote host is prior to 4.4.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-19002 advisory.

  - A vulnerability in the macOS Zoom and RingCentral clients could allow a remote, unauthenticated attacker     to force a user to join a video call with the video camera active. The vulnerability is due to     insufficient authorization controls to check which systems may communicate with the local Zoom Web server     running on port 19421. An attacker could exploit this vulnerability by creating a malicious website that     causes the Zoom client to automatically join a meeting set up by the attacker. Zoom implemented a new     Video Preview dialog that is presented to the user before joining a meeting in Client version 4.4.5     published July 14, 2019. This dialog enables the user to join the meeting with or without video enabled     and requires the user to set their desired default behavior for video. Zoom urges customers to install the     latest Zoom Client release available at https://zoom.us/download. (CVE-2019-13450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Zoom Client for Meetings installed on the remote macOS host is 4.x prior to 4.4.53932.0709. It is, therefore, affected by multiple vulnerabilities. 

  - A denial of service vulnerability exists in Zoom due to an issue with the local webserver. An     unauthenticated, remote attacker can exploit this issue, by convincing a user to click on a crafted link,     to cause continual focus grabs and cause the application to stop responding. (CVE_2020-13449)

  - A webcam hijacking vulnerability exists in Zoom due to websites being able to interact with the Zoom     webserver on localhost ports 19421 and 19424. An unauthenticated, remote attacker can exploit this, by     convincing a user to visit an attacker controlled website, to force a user to join an attacker controlled     video call with their video camera active. (CVE-2020-13450)     
  - A remote code execution vulnerability exists in the Zoom Client due to a bug with the ZoomOpener daemon.
    An authenticated, remote attacker can exploit this, by convincing a user to visit a maliciously crafted     launch URL, to execute arbitrary commands. (CVE-2019-13567)     Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
168819	Zoom Client for Meetings < 4.4.5 Vulnerability (ZSB-19002)	Nessus	MacOS X Local Security Checks	medium
126590	Zoom Client for Meetings 4.x < 4.4.53932.0709 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2019-13450

medium

Tenable Plugins

medium

high