CVE-2025-0143
📋 TL;DR
An out-of-bounds write vulnerability in Zoom Workplace App for Linux allows unauthorized attackers to cause denial of service via network access. This affects Linux users running Zoom Workplace App versions before 6.2.5. The vulnerability requires network access to the target system.
💻 Affected Systems
- Zoom Workplace App
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Zoom Workplace App, potentially requiring system reboot or reinstallation.
Likely Case
Application crash or instability affecting Zoom functionality on the affected system.
If Mitigated
Limited impact with proper network segmentation and updated software.
🎯 Exploit Status
Vulnerability requires network access but no authentication. Specific exploit details not publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.5
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25002/
Restart Required: Yes
Instructions:
1. Open Zoom Workplace App. 2. Click your profile picture. 3. Select 'Check for Updates'. 4. Follow prompts to install version 6.2.5 or later. 5. Restart the application.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Zoom Workplace App to trusted networks only
sudo ufw deny out to any port 8801
sudo ufw deny in from any port 8801
Application Firewall Rules
linuxConfigure firewall to block external access to Zoom application ports
sudo iptables -A INPUT -p tcp --dport 8801 -j DROP
sudo iptables -A OUTPUT -p tcp --dport 8801 -j DROP
🧯 If You Can't Patch
- Disable Zoom Workplace App network access via firewall rules
- Use alternative Zoom clients (web or mobile) until patching possible
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in application settings or via command: zoom --versionCheck Version:
zoom --version | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Confirm version is 6.2.5 or higher and test Zoom functionality📡 Detection & Monitoring
Log Indicators:
- Zoom application crashes
- Segmentation fault errors in system logs
- Unexpected Zoom process termination
Network Indicators:
- Unusual network traffic to Zoom ports (typically 8801)
- Multiple connection attempts to Zoom from single source
SIEM Query:
source="zoom.log" AND ("segmentation fault" OR "crash" OR "abnormal termination")