cve-2021-34409
Vulnerability from cvelistv5
Published
2021-09-27 13:55
Modified
2024-09-16 23:46
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user's machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.
References
security@zoom.ushttps://explore.zoom.us/en/trust/security/security-bulletinVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://explore.zoom.us/en/trust/security/security-bulletinVendor Advisory
Impacted products
Vendor Product Version
Zoom Video Communications Inc Zoom Client for Meetings for MacOS (Standard and for IT Admin) Version: unspecified   < 5.2.0
 Create a notification for this product.
   Zoom Video Communications Inc Zoom Client Plugin for Sharing iPhone/iPad Version: unspecified   < 5.2.0
 Create a notification for this product.
   Zoom Video Communications Inc Zoom Rooms for Conference Version: unspecified   < 5.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:12:50.177Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Zoom Client for Meetings for MacOS (Standard and for IT Admin)",
          "vendor": "Zoom Video Communications Inc",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Zoom Client Plugin for Sharing iPhone/iPad",
          "vendor": "Zoom Video Communications Inc",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Zoom Rooms for Conference",
          "vendor": "Zoom Video Communications Inc",
          "versions": [
            {
              "lessThan": "5.1.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lockheed Martin Red Team"
        }
      ],
      "datePublic": "2021-12-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user\u0027s machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-14T19:28:13",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
        }
      ],
      "source": {
        "discovery": "USER"
      },
      "title": "Zoom Client Installer Local Privilege Escalation",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "Zoom Communications Inc",
          "ASSIGNER": "security@zoom.us",
          "DATE_PUBLIC": "2021-12-14T15:00:00.000Z",
          "ID": "CVE-2021-34409",
          "STATE": "PUBLIC",
          "TITLE": "Zoom Client Installer Local Privilege Escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Zoom Client for Meetings for MacOS (Standard and for IT Admin)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Zoom Client Plugin for Sharing iPhone/iPad",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Zoom Rooms for Conference",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Zoom Video Communications Inc"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Lockheed Martin Red Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user\u0027s machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Creation of Temporary File in Directory with Insecure Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://explore.zoom.us/en/trust/security/security-bulletin",
              "refsource": "MISC",
              "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
            }
          ]
        },
        "source": {
          "discovery": "USER"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2021-34409",
    "datePublished": "2021-09-27T13:55:40.225848Z",
    "dateReserved": "2021-06-09T00:00:00",
    "dateUpdated": "2024-09-16T23:46:09.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-34409\",\"sourceIdentifier\":\"security@zoom.us\",\"published\":\"2021-09-27T14:15:08.137\",\"lastModified\":\"2024-11-21T06:10:20.527\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user\u0027s machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado que los paquetes de instalaci\u00f3n de Zoom Client for Meetings para MacOS (Standard y para IT Admin) antes de la versi\u00f3n 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad antes de la versi\u00f3n 5.2.0, y Zoom Rooms for Conference antes de la versi\u00f3n 5.1.0, copian scripts de shell previos y posteriores a la instalaci\u00f3n en un directorio escribible por el usuario. En los productos afectados que se enumeran a continuaci\u00f3n, un actor malintencionado con acceso local a la m\u00e1quina de un usuario podr\u00eda utilizar este defecto para ejecutar potencialmente comandos arbitrarios del sistema en un contexto con mayores privilegios durante el proceso de instalaci\u00f3n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@zoom.us\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.1,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:meetings:*:*:*:*:*:macos:*:*\",\"versionEndExcluding\":\"5.2.0\",\"matchCriteriaId\":\"37C37A72-A64B-4823-B1E1-4EB0B7283629\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:rooms:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.1.0\",\"matchCriteriaId\":\"BA912D24-7983-4F87-B845-7464F24EE239\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:screen_sharing:*:*:*:*:*:ipados:*:*\",\"versionEndExcluding\":\"5.2.0\",\"matchCriteriaId\":\"7B7ED4B1-5A0F-4738-AC25-46846F3D1127\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:screen_sharing:*:*:*:*:*:iphone_os:*:*\",\"versionEndExcluding\":\"5.2.0\",\"matchCriteriaId\":\"FC50FFA5-57A1-4E3C-A53B-8B0622A437FA\"}]}]}],\"references\":[{\"url\":\"https://explore.zoom.us/en/trust/security/security-bulletin\",\"source\":\"security@zoom.us\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://explore.zoom.us/en/trust/security/security-bulletin\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.