Vulnerability · Published Nov 11, 2021 · Assigned by Zoom
CVE-2021-34418Pre-auth Null pointer crash in on-premise web console
Medium 4.0
In plain English
A medium-severity security flaw in Zoom On-Premise Meeting Connector from Zoom Video Communications Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
The login routine of the web console in the Zoom On-Premise Meeting Connector before version 4.6.239.20200613, Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613, Zoom On-Premise Recording Connector before version 3.8.42.20200905, Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612, and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616 fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zoom Video Communications Inc | Zoom On-Premise Meeting Connector | unspecified – before 4.6.239.20200613 |
| Zoom Video Communications Inc | Zoom On-Premise Meeting Connector MMR | unspecified – before 4.6.239.20200613 |
| Zoom Video Communications Inc | Zoom On-Premise Recording Connector | unspecified – before 3.8.42.20200905 |
| Zoom Video Communications Inc | Zoom On-Premise Virtual Room Connector | unspecified – before 4.4.6344.20200612 |
| Zoom Video Communications Inc | Zoom On-Premise Virtual Room Connector Load Balancer | unspecified – before 2.5.5492.20200616 |
References
- https://explore.zoom.us/en/trust/security/security-bulletin x_refsource_MISC