CVE-2021-34409
Description
It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user's machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.
How to fix
- zoom meetings5.2.0 or later
- zoom rooms5.1.0 or later
- zoom screen_sharing5.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zoom meetings | v < 5.2.0 | 5.2.0 |
| zoom rooms | v < 5.1.0 | 5.1.0 |
| zoom screen_sharing | v < 5.2.0 | 5.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.