Local Privilege Escalation in Auto Updater for Zoom Client for Meetings for macOS

Vulnerability

The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process [1]. A local low-privileged user could exploit this vulnerability to escalate their privileges to root [1]. The affected versions are 5.7.3 through 5.11.5 inclusive.

Exploitation

An attacker needs local access to the macOS system and a low-privileged user account [1]. The exploitability depends on the ability to manipulate the auto-update mechanism, which runs with elevated privileges. The precise sequence of steps is not detailed in available references, but the vulnerability exists within the update process logic.

Impact

Successful exploitation allows the attacker to gain root privileges on the affected macOS system [1]. This effectively gives the attacker full control over the system, including the ability to install software, modify system files, and access all user data.

Mitigation

Zoom addressed this vulnerability in version 5.11.6 [1]. Users should update their Zoom Client for Meetings to the latest version [1]. No workarounds are mentioned in the available references.