NVD Vulnerability Detail

CVE-2021-34423

Summary	A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.
Publication Date	Nov. 25, 2021, 2:15 a.m.
Registration Date	Nov. 25, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:10 p.m.

CVSS3.1 : CRITICAL
スコア	9.8
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings::::::::					5.8.3
execution environment
1	cpe:2.3:o:google:android:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings::::::::					5.8.4
execution environment
1	cpe:2.3:o:apple:macos:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings::::::::					5.8.4
execution environment
1	cpe:2.3:o:apple:iphone_os:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings::::::::					5.8.4
execution environment
1	cpe:2.3:o:linux:linux_kernel:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings::::::::					5.8.4
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings_for_blackberry::::::::					5.8.1
execution environment
1	cpe:2.3:o:google:android:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings_for_blackberry::::::::					5.8.1
execution environment
1	cpe:2.3:o:apple:iphone_os:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings_for_intune::::::::					5.8.4
execution environment
1	cpe:2.3:o:apple:iphone_os:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings_for_intune::::::::					5.8.4
execution environment
1	cpe:2.3:o:google:android:-:::::::*

Configuration10		or higher	or less	more than	less than
cpe:2.3:a:zoom:meetings_for_chrome_os::::::::					5.0.1

Configuration11		or higher	or less	more than	less than
cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:google:android:-:::::::*

Configuration12		or higher	or less	more than	less than
cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:apple:macos:-:::::::*

Configuration13		or higher	or less	more than	less than
cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration14		or higher	or less	more than	less than
cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:microsoft:windows:-:::::::*

Configuration15		or higher	or less	more than	less than
cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:apple:iphone_os:-:::::::*

Configuration16		or higher	or less	more than	less than
cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::					5.8.3
execution environment
1	cpe:2.3:o:google:android:-:::::::*

Configuration17		or higher	or less	more than	less than
cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::					5.8.4

Configuration18	or higher	or less	more than	less than
cpe:2.3:a:zoom:windows_meeting_sdk::::::::				5.7.6.1081
cpe:2.3:a:zoom:macos_meeting_sdk::::::::				5.7.6.1340
cpe:2.3:a:zoom:iphone_os_meeting_sdk::::::::				5.7.6.1082
cpe:2.3:a:zoom:android_meeting_sdk::::::::				5.7.6.1922

Configuration19	or higher	or less	more than	less than
cpe:2.3:a:zoom:windows_video_sdk::::::::				1.1.2
cpe:2.3:a:zoom:iphone_os_video_sdk::::::::				1.1.2
cpe:2.3:a:zoom:macos_video_sdk::::::::				1.1.2
cpe:2.3:a:zoom:android_video_sdk::::::::				1.1.2

Configuration20	or higher	or less	more than	less than
cpe:2.3:a:zoom:hybrid_mmr::::::::				4.6.20211116.131
cpe:2.3:a:zoom:hybrid_zproxy::::::::				1.0.1058.20211116
cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_controller::::::::				4.8.12.20211115
cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector::::::::				4.4.7266.20211117
cpe:2.3:a:zoom:zoom_on-premise_recording_connector::::::::				5.1.0.65.20211116
cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector_load_balancer::::::::				2.5.5692.20211117
cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr::::::::				4.8.12.20211115

Configuration21	or higher	or less	more than	less than
cpe:2.3:a:zoom:vdi_vmware::::::::				5.8.4.21112
cpe:2.3:a:zoom:vdi_citrix::::::::				5.8.4.21112
cpe:2.3:a:zoom:vdi_azure_virtual_desktop::::::::				5.8.4.21112
cpe:2.3:a:zoom:vdi_windows_meeting_client::::::::				5.8.4

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/165417/Zoom-Chat-Message-Processing-Buffer-Overflow.html	Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/165417/Zoom-Chat-Message-Processing-Buffer-Overflow.html	Third Party Advisory VDB Entry
3	https://explore.zoom.us/en/trust/security/security-bulletin	Vendor Advisory
4	https://explore.zoom.us/en/trust/security/security-bulletin	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-120	古典的バッファオーバーフロー	https://cwe.mitre.org/data/definitions/120.html

JVN Vulnerability Information

複数の Zoom 製品における古典的バッファオーバーフローの脆弱性

Title	複数の Zoom 製品における古典的バッファオーバーフローの脆弱性
Summary	複数の Zoom 製品には、古典的バッファオーバーフローの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 24, 2021, midnight
Registration Date	Nov. 30, 2022, 11:08 a.m.
Last Update	Nov. 30, 2022, 11:08 a.m.

Affected System

Zoom Video Communications, Inc.

Controllers for Zoom Rooms

Zoom Meeting SDK for Android

Zoom Meeting SDK for iOS

Zoom Meeting SDK for macOS

Zoom Meetings

Zoom Meetings for BlackBerry

Zoom Meetings for Chrome OS

Zoom Meetings for Intune

Zoom Rooms for Conference Rooms

Zoom VDI

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-34423	https://www.cve.org/CVERecord?id=CVE-2021-34423
National Vulnerability Database (NVD)
2	CVE-2021-34423	https://nvd.nist.gov/vuln/detail/CVE-2021-34423

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-120	https://cwe.mitre.org/data/definitions/120.html

ベンダー情報

No	Name	URL
Zoom
1	Security Bulletin	https://explore.zoom.us/en/trust/security/security-bulletin

Change Log

No	Changed Details	Date of change
1	[2022年11月30日] 掲載	Nov. 30, 2022, 11:08 a.m.