Sign-up

ID

VAR-201907-0715


CVE

CVE-2019-13449


TITLE

Zoom Client Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-006423

DESCRIPTION

In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&confno= requests to localhost port 19421. Zoom Client Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. ZoomClient is a video conferencing terminal that supports multiple platforms from Zoom Company of the United States. There is a security hole in ZoomClient

Trust: 2.16

sources: NVD: CVE-2019-13449 // JVNDB: JVNDB-2019-006423 // CNVD: CNVD-2019-21754

IOT TAXONOMY

category:['IoT', 'ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-21754

AFFECTED PRODUCTS

vendor:zoommodel:zoomscope:ltversion:4.4.2

Trust: 1.0

vendor:zoom videomodel:clientscope:ltversion:4.4.2 (macos)

Trust: 0.8

vendor:zoommodel:client on macosscope:ltversion:4.4.2

Trust: 0.6

sources: CNVD: CNVD-2019-21754 // JVNDB: JVNDB-2019-006423 // NVD: CVE-2019-13449

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-13449
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-13449
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2019-21754
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201907-489
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-13449
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-21754
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-13449
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-21754 // JVNDB: JVNDB-2019-006423 // CNNVD: CNNVD-201907-489 // NVD: CVE-2019-13449

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2019-006423 // NVD: CVE-2019-13449

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-489

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201907-489

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-006423

PATCH
title:Zoom@zoom_usurl:https://twitter.com/zoom_us/status/1148710712241295361
Trust: 0.8
title:VIDEO ON VULNERABILITYurl:https://assets.zoom.us/docs/pdf/Zoom+Response+Video-On+Vulnerability.pdf
Trust: 0.8
title:Response to Video-On Concernurl:https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/
Trust: 0.8
title:Patch for ZoomClientDOS vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/167559
Trust: 0.6
title:Zoom Client Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94628
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-21754 // 
            
            
            
            JVNDB: JVNDB-2019-006423 // 
            
            
            
            CNNVD: CNNVD-201907-489

EXTERNAL IDS
db:NVDid:CVE-2019-13449
Trust: 3.0
db:JVNDBid:JVNDB-2019-006423
Trust: 0.8
db:CNVDid:CNVD-2019-21754
Trust: 0.6
db:CNNVDid:CNNVD-201907-489
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-21754 // 
            
            
            
            JVNDB: JVNDB-2019-006423 // 
            
            
            
            CNNVD: CNNVD-201907-489 // 
            
            
            
            NVD: CVE-2019-13449

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2019-13449
Trust: 2.0
url:https://twitter.com/zoom_us/status/1148710712241295361
Trust: 1.6
url:https://assets.zoom.us/docs/pdf/zoom+response+video-on+vulnerability.pdf
Trust: 1.6
url:https://blog.zoom.us/wordpress/2019/07/08/response-to-video-on-concern/
Trust: 1.6
url:https://bugs.chromium.org/p/chromium/issues/detail?id=951540
Trust: 1.6
url:https://medium.com/%40jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13449
Trust: 0.8
url:https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-21754 // 
            
            
            
            JVNDB: JVNDB-2019-006423 // 
            
            
            
            CNNVD: CNNVD-201907-489 // 
            
            
            
            NVD: CVE-2019-13449

SOURCES
db:CNVDid:CNVD-2019-21754
db:JVNDBid:JVNDB-2019-006423
db:CNNVDid:CNNVD-201907-489
db:NVDid:CVE-2019-13449

LAST UPDATE DATE
2024-11-23T22:37:46.380000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-21754date:2019-07-09T00:00:00
db:JVNDBid:JVNDB-2019-006423date:2019-07-19T00:00:00
db:CNNVDid:CNNVD-201907-489date:2019-07-18T00:00:00
db:NVDid:CVE-2019-13449date:2024-11-21T04:24:55.440

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-21754date:2019-07-09T00:00:00
db:JVNDBid:JVNDB-2019-006423date:2019-07-19T00:00:00
db:CNNVDid:CNNVD-201907-489date:2019-07-09T00:00:00
db:NVDid:CVE-2019-13449date:2019-07-09T06:15:10.257