NVD Vulnerability Detail

CVE-2019-13450

Summary	In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
Publication Date	July 9, 2019, 3:15 p.m.
Registration Date	Jan. 26, 2021, 11:38 a.m.
Last Update	Nov. 21, 2024, 1:24 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:ringcentral:ringcentral:7.0.136380.0312:::::mac_os_x::
cpe:2.3:a:zoom:zoom::::::mac_os_x::*		4.4.4

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/109082	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/109082	Third Party Advisory VDB Entry
3	https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf	Vendor Advisory
4	https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf	Vendor Advisory
5	https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/	Vendor Advisory
6	https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/	Vendor Advisory
7	https://bugs.chromium.org/p/chromium/issues/detail?id=951540	Exploit Third Party Advisory
8	https://bugs.chromium.org/p/chromium/issues/detail?id=951540	Exploit Third Party Advisory
9	https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
10	https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
11	https://news.ycombinator.com/item?id=20387298	Issue Tracking Third Party Advisory
12	https://news.ycombinator.com/item?id=20387298	Issue Tracking Third Party Advisory
13	https://twitter.com/moreati/status/1148548799813640193	Third Party Advisory
14	https://twitter.com/moreati/status/1148548799813640193	Third Party Advisory
15	https://twitter.com/zoom_us/status/1148710712241295361	Third Party Advisory
16	https://twitter.com/zoom_us/status/1148710712241295361	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-862	認証の欠如	https://cwe.mitre.org/data/definitions/862.html

JVN Vulnerability Information

Zoom Client および RingCentral におけるアクセス制御に関する脆弱性

Title	Zoom Client および RingCentral におけるアクセス制御に関する脆弱性
Summary	Zoom Client および RingCentral には、アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 8, 2019, midnight
Registration Date	July 18, 2019, 3:18 p.m.
Last Update	July 18, 2019, 3:18 p.m.

Affected System

Zoom Video Communications, Inc.

Zoom Client 4.4.4 まで (macOS)

RingCentral, Inc.

RingCentral 7.0.136380.0312 (macOS)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-13450	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13450
National Vulnerability Database (NVD)
2	CVE-2019-13450	https://nvd.nist.gov/vuln/detail/CVE-2019-13450

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
RingCentral
1	Top Page	https://www.ringcentral.com/
Twitter
2	Zoom@zoom_us	https://twitter.com/zoom_us/status/1148710712241295361
Zoom
3	VIDEO ON VULNERABILITY	https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf
Zoom Blog
4	Response to Video-On Concern	https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/

その他

No	Name	URL
関連文書
1	Vulnerability in the Mac Zoom client allows malicious websites to enable camera	https://news.ycombinator.com/item?id=20387298

Change Log

No	Changed Details	Date of change
1	[2019年07月18日] 掲載	July 18, 2019, 3:18 p.m.