CVE-2019-13450 : What You Need to Know

Remote attackers can exploit a vulnerability in Zoom Client versions up to 4.4.4 and RingCentral version 7.0.136380.0312 on macOS to make a user join a video call with an active camera. Even after uninstalling Zoom Client, the machine remains vulnerable.

Understanding CVE-2019-13450

This CVE highlights a security flaw in Zoom Client and RingCentral versions on macOS that allows remote attackers to force users into video calls with active cameras.

What is CVE-2019-13450?

Attackers can manipulate the Zoom web server on localhost ports 19421 or 19424 to initiate video calls without user consent.
Uninstalling Zoom Client does not remove the vulnerability, leaving the system exposed.

The Impact of CVE-2019-13450

Potential unauthorized access to users' video cameras during video calls.
Risk of privacy invasion and unauthorized monitoring.

Technical Details of CVE-2019-13450

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

Exploitable flaw in Zoom Client and RingCentral versions on macOS allowing forced video calls.

Affected Systems and Versions

Zoom Client versions up to 4.4.4 and RingCentral version 7.0.136380.0312 on macOS.

Exploitation Mechanism

Any website can interact with the Zoom web server on localhost ports 19421 or 19424, enabling unauthorized video call initiation.

Mitigation and Prevention

Protecting systems from CVE-2019-13450 requires immediate actions and long-term security practices.

Immediate Steps to Take

Adjust ZDisableVideo preference to mitigate the vulnerability.
Terminate the web server to prevent unauthorized access.
Remove the ~/.zoomus directory to eliminate potential risks.
Create a plain file named ~/.zoomus to enhance security.

Long-Term Security Practices

Regularly update Zoom Client and RingCentral to the latest versions.
Monitor for security advisories and apply patches promptly.

Patching and Updates

Stay informed about security updates from Zoom and RingCentral.
Apply patches and security fixes as soon as they are released.