It rolled out an update earlier this year to prevent your Mac’s microphone from staying active even after you left a call. The company was forced to address a major vulnerability in 2019 that allowed websites to hijack your Mac’s webcams. This is only the latest example of Zoom’s oftentimes lackluster security practices. You can update your Zoom app on your Mac to version 5.11.5 (9788) to protect yourself. Zoom quickly then rolled out an update to its Mac app to patch the vulnerability. Zoom Client for Meetings for macOS (Standard and for IT Admin) starting version 5.7.3 and before version 5.11.5.The company said that the vulnerability in the auto-update process could allow a “local low-privileged user” to “escalate their privileges to root.” The affected versions of Zoom are the following:

Zoom issued a security bulletin after Wardle detailed the vulnerability. That meant malicious actors could force Zoom to downgrade to a buggier, less-secure version or even pass it an entirely different package that could give them root access to the system. Certification Authority Apple Root CA.pkg“), this check could be bypassed. The problem is that by simply passing the verification checker the name of the package it was looking for (“ Zoom Video.

It seemed secure, as only Zoom clients could connect to the privileged daemon, and only packages signed by Zoom could be extracted. What this means is that malicious actors could bypass the verification checker and either downgrade to an old, less secure version of Zoom or pass an entirely different package to the updater.

Wardle detailed the vulnerability at Def Con last week, explaining that Zoom’s auto-update feature doesn’t ask for a user password and is enabled by default. The Zoom for Mac update addresses a major security vulnerability that could have allowed anyone to gain root access to your computer.Īs reported by ArsTechnica, the vulnerability was first discovered by well-known security researcher Patrick Wardle. If you’re a Zoom user with a Mac, there’s a critical security fix rolling out now that you should install immediately.

Zoom update from staying active after