Zoom exploit in MacOS may still not be fully patched against privilege escalation

lizkat

Watching March roll out real winter
Posts
7,341
Reaction score
15,163
Location
Catskill Mountains
Doesn't sound great. Even after they patched it there could still be escalation of privileges? Another tweak needed?


A few weeks before the Def Con event, Wardle says Zoom issued a patch that fixed the bugs that he had initially discovered. But on closer analysis, another small error meant the bug was still exploitable.

In the new version of the update installer, a package to be installed is first moved to a directory owned by the “root” user. Generally this means that no user that does not have root permission is able to add, remove, or modify files in this directory. But because of a subtlety of Unix systems (of which macOS is one), when an existing file is moved from another location to the root directory, it retains the same read-write permissions it previously had. So, in this case, it can still be modified by a regular user. And because it can be modified, a malicious user can still swap the contents of that file with a file of their own choosing and use it to become root.

While this bug is currently live in Zoom, Wardle says it’s very easy to fix and that he hopes that talking about it publicly will “grease the wheels” to have the company take care of it sooner rather than later.

Zoom had not responded to a request for comment at time of publication.
 
Top Bottom
1 2