NVD

CVE-2021-34423 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Description

A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nist CVSS score does not match with CNA score

CNA: Zoom Video Communications, Inc.

Base Score: 7.3 HIGH

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 7.5 HIGH

Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://packetstormsecurity.com/files/165417/Zoom-Chat-Message-Processing-Buffer-Overflow.html	Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165417/Zoom-Chat-Message-Processing-Buffer-Overflow.html	Third Party Advisory VDB Entry
https://explore.zoom.us/en/trust/security/security-bulletin	Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

6 change records found show changes

Initial Analysis by NIST 12/03/2021 12:55:38 PM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CVSS V2		NIST (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Added	CWE		NIST CWE-120
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:apple:iphone_os:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:google:android:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:controllers_for_zoom_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:microsoft:windows:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:google:android:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:apple:iphone_os:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:apple:macos:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:linux:linux_kernel:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:microsoft:windows:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings_for_blackberry::::::::* versions up to (excluding) 5.8.1 OR cpe:2.3:o:apple:iphone_os:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings_for_blackberry::::::::* versions up to (excluding) 5.8.1 OR cpe:2.3:o:google:android:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings_for_intune::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:apple:iphone_os:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:meetings_for_intune::::::::* versions up to (excluding) 5.8.4 OR cpe:2.3:o:google:android:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:apple:macos:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:google:android:-:::::::*
Added	CPE Configuration		AND OR cpe:2.3:a:zoom:rooms_for_conference_rooms::::::::* versions up to (excluding) 5.8.3 OR cpe:2.3:o:microsoft:windows:-:::::::*
Added	CPE Configuration		OR cpe:2.3:a:zoom:android_meeting_sdk::::::::* versions up to (excluding) 5.7.6.1922 cpe:2.3:a:zoom:iphone_os_meeting_sdk::::::::* versions up to (excluding) 5.7.6.1082 cpe:2.3:a:zoom:macos_meeting_sdk::::::::* versions up to (excluding) 5.7.6.1340 cpe:2.3:a:zoom:windows_meeting_sdk::::::::* versions up to (excluding) 5.7.6.1081
Added	CPE Configuration		OR cpe:2.3:a:zoom:android_video_sdk::::::::* versions up to (excluding) 1.1.2 cpe:2.3:a:zoom:iphone_os_video_sdk::::::::* versions up to (excluding) 1.1.2 cpe:2.3:a:zoom:macos_video_sdk::::::::* versions up to (excluding) 1.1.2 cpe:2.3:a:zoom:windows_video_sdk::::::::* versions up to (excluding) 1.1.2
Added	CPE Configuration		Record truncated, showing 500 of 807 characters. View Entire Change Record OR cpe:2.3:a:zoom:hybrid_mmr::::::::* versions up to (excluding) 4.6.20211116.131 cpe:2.3:a:zoom:hybrid_zproxy::::::::* versions up to (excluding) 1.0.1058.20211116 cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_controller::::::::* versions up to (excluding) 4.8.12.20211115 cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr::::::::* versions up to (excluding) 4.8.12.20211115 cpe:2.3:a:zoom:zoom_on-premise_recording_connector:::::
Added	CPE Configuration		OR cpe:2.3:a:zoom:meetings_for_chrome_os::::::::* versions up to (excluding) 5.0.1
Added	CPE Configuration		OR cpe:2.3:a:zoom:vdi_azure_virtual_desktop::::::::* versions up to (excluding) 5.8.4.21112 cpe:2.3:a:zoom:vdi_citrix::::::::* versions up to (excluding) 5.8.4.21112 cpe:2.3:a:zoom:vdi_vmware::::::::* versions up to (excluding) 5.8.4.21112 cpe:2.3:a:zoom:vdi_windows_meeting_client::::::::* versions up to (excluding) 5.8.4
Added	CPE Configuration		OR cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::* versions up to (excluding) 5.8.4
Changed	Reference Type	https://explore.zoom.us/en/trust/security/security-bulletin No Types Assigned	https://explore.zoom.us/en/trust/security/security-bulletin Vendor Advisory

Quick Info

CVE Dictionary Entry:
CVE-2021-34423
NVD Published Date:
11/24/2021
NVD Last Modified:
11/21/2024
Source:
Zoom Video Communications, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2021-34423 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by CVE 11/21/2024 1:10:22 AM

CVE Modified by Zoom Video Communications, Inc. 5/14/2024 5:13:09 AM

Modified Analysis by NIST 4/29/2022 1:57:42 PM

CVE Modified by Zoom Video Communications, Inc. 1/03/2022 4:15:08 PM

Initial Analysis by NIST 12/03/2021 12:55:38 PM

CVE Modified by Zoom Video Communications, Inc. 12/02/2021 4:15:06 AM

Quick Info