CVE-2019-13450
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 3.5%
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
Produtos afetados
n/a · n/aReferências
https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdfhttps://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/https://bugs.chromium.org/p/chromium/issues/detail?id=951540https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5https://news.ycombinator.com/item?id=20387298https://twitter.com/moreati/status/1148548799813640193https://twitter.com/zoom_us/status/1148710712241295361http://www.securityfocus.com/bid/109082