| Title | Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input | |
| Date | Monday April 12 2021, @07:01PM | |
| Author | martyb | |
| Topic | ||
| from the I-can-haz-pwnie? dept. | ||
Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input:
A zero-day vulnerability in Zoom which can be used to launch remote code execution (RCE) attacks has been disclosed by researchers.
Pwn2Own, organized by the Zero Day Initiative, is a contest for white-hat cybersecurity professionals and teams to compete in the discovery of bugs in popular software and services.
[...] For successful entrants, the financial rewards can be high -- and in this case, Daan Keuper and Thijs Alkemade earned themselves $200,000 for their Zoom discovery.
The researchers from Computest demonstrated a three-bug attack chain that caused an RCE on a target machine, and all without any form of user interaction.
[...] As noted by Malwarebytes, the attack works on both Windows and Mac versions of Zoom, but it has not -- yet -- been tested on iOS or Android. The browser version of the videoconferencing software is not impacted.
In a statement to Tom's Guide, Zoom thanked the Computest researchers and said the company was "working to mitigate this issue with respect to Zoom Chat." In-session Zoom Meetings and Zoom Video Webinars are not affected.
"The attack must also originate from an accepted external contact or be a part of the target's same organizational account," Zoom added. "As a best practice, Zoom recommends that all users only accept contact requests from individuals they know and trust."
[...] End-users just need to wait for a patch to be issued -- but if worried, they can use the browser version in the meantime.
| Links |
printed from SoylentNews, Critical Zoom Vulnerability Triggers Remote Code Execution Without User Input on 2024-05-14 16:31:10