CVE-2019-13567
Summary
| CVE | CVE-2019-13567 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-07-12 04:15:00 UTC |
| Updated | 2020-08-24 17:37:00 UTC |
| Description | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Zoom RCE - CVE-2019-13567 · GitHub | MISC | gist.github.com | Third Party Advisory |
| William Bowling na Twitterze: "Here are the details on the Zoom RCE (CVE-2019-13567) that we sent to mitre, worked on the latest (and last) ZoomOpener which had the host check and signature verification https://t.co/4x8AW4YkR9" | MISC | twitter.com | Third Party Advisory |
| New Updates for Mac OS – Zoom Support Center | MISC | support.zoom.us | Release Notes, Vendor Advisory |
| William Bowling na Twitterze: "So yes, there was an RCE in the hidden zoom web server... Great work by @JLLeitschuh for the initial research, for more details on if you're affected see https://t.co/8oJHpN8Cw5 CVE-2019-13567… https://t.co/iqMqzUSzJs" | MISC | twitter.com | Exploit, Third Party Advisory |
| Jonathan Leitschuh di Twitter: "Specifically, you are vulnerable if you've uninstalled the Zoom application from your computer without killing the ZoomOpener process and then deleting `~/.zoomus` directory. Apple is rolling out a fix, but if you haven't gotten it yet, or you haven't updated, you are vulnerable… https://t.co/rPqgF8hFFO" | MISC | twitter.com | Third Party Advisory |
| Jonathan Leitschuh di Twitter: "???? RCE Alert! ???? That @zoom_us daemon (hidden web server) is now known to have a Remote Code Execution Vulnerability! ????Proof of concepts exist! ???? Mac Admins: make sure Zoom is up to date or that daemon is removed! This vulnerability is now tracked under: CVE-2019-13567… https://t.co/a9pseiLGY8" | MISC | twitter.com | Third Party Advisory |
| Patrick Gray na Twitteru: "So one more detail on the Zoom bug that I didn't know previously -- it only affected you if you'd installed Zoom then removed it, leaving behind its shitty little webserver. This is the first time I've seen software make people more vulnerable when they actually uninstalled it." | MISC | twitter.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.