Zoom Patches High-Severity Flaw in macOS Client

Online video messaging system Zoom introduced a new patch final 7 days to a higher-severity flaw in its consumer for macOS devices.

The vulnerability (tracked CVE-2022-28762) refers to a debugging port misconfiguration affecting variations in between 5.10.6 and 5.12. (excluded) and has a prevalent vulnerability scoring system (CVSS) of 3.1 of 7.3 out of 10.

“When digicam manner rendering context is enabled as portion of the Zoom App Levels API by operating sure Zoom Apps, a area debugging port is opened by the Zoom customer,” the corporation wrote on its security bulletin page last week.

In accordance to the online video messaging firm, if exploited, the flaw could let a malicious actor to hook up to their client and manage the Zoom Applications working in it.

From a specialized standpoint, Zoom Applications are integrations with external apps that consumers can obtain from within just the online video messaging system. They include things like applications these kinds of as Miro, Dropbox Spaces and Asana, amid other people.

The flaw has been spotted by Zoom’s very own security crew and entirely patched in the most up-to-date version of the macOS consumer (5.12.), which is now readily available on the company’s web page and by means of configurations in by now put in iterations of the online video messaging platform.

“Users can aid continue to keep by themselves protected by applying recent updates or downloading the newest Zoom program with all present security updates,” the tech agency wrote.

The security bulletin arrives months soon after Ivan Fratric from Google Project Zero uncovered four vulnerabilities (now patched) that could be exploited to compromise users over chat by sending selected Extensible Messaging and Existence Protocol (XMPP) messages and executing destructive code.

More not too long ago, an investigation by cybersecurity enterprise Cyfirma suggested the threat actors acknowledged as FIN11 (and Clop) may have impersonated web download internet pages of the Zoom application to run phishing campaigns against targets globally.

Some parts of this article are sourced from:
www.infosecurity-journal.com