🇰🇷 한글 설명
Zoom Client for Meetings를 포함한 다양한 Zoom 제품군에서 버퍼 오버플로우 취약점이 발견되었습니다. 공격자는 이 취약점을 악용하여 서비스를 중단시키거나 임의의 코드를 실행할 수 있습니다.
💡 쉬운 설명
프로그램이 처리할 수 있는 데이터 양보다 더 많은 정보가 들어올 때 발생하는 오류입니다. 이를 통해 해커가 컴퓨터를 멈추게 하거나 몰래 명령을 내릴 수 있습니다.
🇺🇸 원문 (English)
A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.
📍 영향받는 시스템
Zoom Client for Meetings (5.8.4 미만), Zoom Rooms (5.8.3 미만), Zoom VDI Plugins, Zoom SDK 등 다수 제품군
⚔️ 공격 벡터
조작된 데이터를 전송하여 메모리 영역을 넘치게 만드는 방식
🛡️ 대응 방법
Zoom 클라이언트 및 관련 소프트웨어를 최신 보안 버전(예: Client 5.8.4 이상)으로 즉시 업데이트하십시오.
🔧 검증 코드
출력된 버전 번호가 취약점이 해결된 버전(예: 5.8.4 이상)인지 확인하십시오.
zoom --version 2>/dev/null || echo 'Please check Zoom version manually in application settings'