A week in security (July 8 – 14)

Last week on Malwarebytes Labs, we looked at ways to send your sensitive information in a secure fashion, examined some tactics in incident response land, and explored federal data privacy law. We also looked at how security tools can turn against you, and took a deep dive into the rather fiendis...

KLA11799 Security vulnerability in Zoom

Security vulnerability was found in Zoom. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions. Original advisories Zoom Security CVE-2019-13450 CVE-2019-13450 Exploitation Malware exists for this vulnerability. Usually such malware is...

Zoom Video Conferencing for macOS Also Vulnerable to Critical RCE Flaw

The chaos and panic that the disclosure of privacy vulnerability in the highly popular and widely-used Zoom video conferencing software created earlier this week is not over yet. As suspected, it turns out that the core issue—a locally installed web server by the software—was not just allowing an...

Zoom Video Conferencing for macOS Also Vulnerable to Critical RCE Flaw

The chaos and panic that the disclosure of privacy vulnerability in the highly popular and widely-used Zoom video conferencing software created earlier this week is not over yet. As suspected, it turns out that the core issue—a locally installed web server by the software—was not just allowing an...

Affects more than four million Network Camera: Zoom client there is a 0 day vulnerability could lead to code execution-vulnerability warning-the black bar safety net

CVE number CVE-2019-13449: the Zoom client denial of Service Vulnerability in 4. 4. 2 version client fix CVE-2019-13450: network cameras information disclosure vulnerability currently are not released patch, plan on 7 November 10 release Foreword Recently, we found Zoom the client there are two...

CVE-2019-13567

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

CVE-2019-13567

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

Remote code execution

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

CVE-2019-13567

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon aka the hidden web server is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a...

CVE-2019-13567

CVE-2019-13567 affects the Zoom Client for macOS, prior to 4.4.53932.0709. The issue arises when the ZoomOpener daemon (a hidden local web server) is running but the Zoom Client is not installed or cannot be opened; an attacker can remotely execute code by using a maliciously crafted launch URL. ...

Apple Issues Silent Update Removing Zoom's Hidden Server

Apple has pushed a silent update to Mac users that removes a hidden web server from Zoom users’ machines. The Zoom web- and video-conferencing service has come under scrutiny for its handling of a zero-day bug CVE-2019–13450 found by researcher Jonathan Leitschuh, which would allow an attacker to...

Zoom Pushes Emergency Patch for Webcam Hijack Flaw

After facing public outcry over its handling of a zero-day vulnerability in its collaboration client for Mac, the Zoom web- and video-conferencing service has rushed out an emergency patch. The flaw CVE-2019–13450, allows a malicious website to hijack a user’s web camera without their permission,...

Zoom Client Webcam Hijacking (CVE-2019-13450)

A Webcam Hijacking vulnerability exists in Zoom Client for macOS. A machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. A remote attacker can force a user to join a video call with the video camera active...

Zoom Client for Meetings 4.x < 4.4.53932.0709 Multiple Vulnerabilities (macOS)

The version of Zoom Client for Meetings installed on the remote macOS host is 4.x prior to 4.4.53932.0709. It is, therefore, affected by multiple vulnerabilities. - A denial of service vulnerability exists in Zoom due to an issue with the local webserver. An unauthenticated, remote attacker can...

Zoom Will Fix the Flaw That Let Hackers Hijack Webcams

While it at first dismissed the vulnerability, Zoom says it will release a patch Tuesday night...

Vulnerability in Zoom video conference app lets Mac’s camera hijacking

By Waqas The vulnerability in the Zoom video conference app lets attackers hijack Mac's camera by merely using malicious websites. The Zoom video conference app is currently being used by millions of users around the world and that makes it a lucrative target for cybercriminals. Jonathan Leitschu...

Zoom Zero-Day Bug Opens Mac Users to Webcam Hijacking

A zero-day vulnerability in the Zoom client for Mac allows a malicious website to hijack a user’s web camera without their permission. Up to 4 million workers that use the Zoom for Mac web-and videoconferencing service are at risk from a flaw in the collaboration client CVE-2019–13450, according ...

A Zoom Flaw Gives Hackers Easy Access to Your Webcam

All it takes is one wrong click, and the popular video conferencing software will put you in a meeting with a stranger...

Flaw in Zoom Video Conferencing Software Lets Websites Hijack Mac Webcams

If you use Zoom video conferencing software on your Mac computer—then beware—any website you're visiting in your web browser can turn on your device camera without your permission. Ironically, even if you had ever installed the Zoom client on your device and simply uninstalled it, a remote attack...

CVE-2019-13450

In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerab...