CVE-2024-42441
📋 TL;DR
A privilege escalation vulnerability in Zoom's macOS installers allows local privileged users to gain higher system privileges. This affects Zoom Workplace Desktop App, Zoom Meeting SDK, and Zoom Rooms Client for macOS. Only macOS systems with affected Zoom versions are impacted.
💻 Affected Systems
- Zoom Workplace Desktop App for macOS
- Zoom Meeting SDK for macOS
- Zoom Rooms Client for macOS
📦 What is this software?
Rooms by Zoom
⚠️ Risk & Real-World Impact
Worst Case
A local privileged user could gain root-level access to the macOS system, enabling complete system compromise, data theft, and persistence.
Likely Case
A local administrator or user with sudo privileges could elevate to root to install malware, modify system files, or access other user data.
If Mitigated
With proper access controls and least privilege principles, impact is limited to authorized administrative actions within expected boundaries.
🎯 Exploit Status
Exploitation requires local access and existing user privileges. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.5 or later
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-24034
Restart Required: Yes
Instructions:
1. Open Zoom application. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Install version 6.1.5 or newer. 5. Restart the application and system if prompted.
🔧 Temporary Workarounds
Remove local admin privileges
allRestrict local administrative access to minimize attack surface
Disable affected Zoom applications
linuxTemporarily disable Zoom until patching is possible
sudo rm -rf /Applications/zoom.us.app
🧯 If You Can't Patch
- Implement strict least privilege access controls for local user accounts
- Monitor for unusual privilege escalation attempts using macOS security logs
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in application settings or run: defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionStringCheck Version:
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Verify version is 6.1.5 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation events in macOS system logs
- Zoom installer processes running with unexpected privileges
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
source="macos_system_logs" AND (event="privilege_escalation" OR process="zoom" AND action="install")