IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Zoom patches privilege escalation flaw for macOS users

Threat actors were able to use the application’s updater to distribute malicious files at superuser level

A telephoto shot of the Zoom logo on a glass building, with blue sky above

Communications company Zoom has released a patch to address a flaw that allowed threat actors to control a victim’s operating system on macOS.

The Zoom client has limited permissions as far as access to critical system files is concerned. However, once installed the Zoom auto-update function would run in the background continuously, with superuser privileges. 

Related Resource

Adding value to Microsoft Teams beyond voice connectivity

How AudioCodes can understand your broader business communication needs and fill in the gaps

Adding value to Microsoft Teams beyond voice connectivity whitepaper coverFree Download

In normal circumstances, this would simply check for updates from Zoom to install. Upon receiving one, the Zoom updater would run a process to verify that the update bore a cryptographic signature from the company, and was, therefore, a legitimate file to run.

Objective-See founder Patrick Wardle discovered that any file, renamed with Zoom’s cryptographic certificate, would be accepted by the updater as a legitimate Zoom file. As a result, threat actors could use the Zoom updater to run any file as a superuser.

As a result of the flaw, Zoom for macOS had unwittingly become a launchpad for privilege escalation attacks, in which a threat actor with limited access to a victim’s machine uses an exploit to gain elevated privileges that give them greater control. In the case of the Zoom flaw, threat actors could use the updater to delete or amend key system files, with the superuser privilege granting almost unlimited access to the machines of victims.

An update, released on August 13 by Zoom, has now appeared to have fixed the problem. On its security bulletin, the company identified the issue being fixed as “a vulnerability in the auto-update process".

“We released an update to address the newly reported vulnerability for the macOS auto updater in the Zoom Client for Meetings for macOS version 5.11.5 and are evaluating additional security enhancements,” said a Zoom spokesperson, in a statement to IT Pro.

This is not the first flaw found with Zoom's macOS app, with an update released earlier this year addressing an issue in which the microphones of users continued to be accessed by the Zoom client even after a meeting had ended.

Wardle exposed the flaw publicly during his talk ‘"You're M̶u̶t̶e̶d̶ Rooted’ at the Def Con hacking conference on August 12, stating that he had made the company aware of it through the proper channels as far back as December 2021.

In the months that followed, the company was reportedly slow to act. On August 9, a patch designated CVE-2022-28751 was released, but Wardle found that the exploit was still achievable after the patch through an unspecified extra step.

Since the update, Wardle has voiced his approval on Twitter, stating “Mahalos to @Zoom for the (incredibly) quick fix!”. He also detailed the key change that the update brings, namely that the Zoom installer now invokes a function called lchown to modify the update file’s permissions, rather than the updater running at constant superuser privilege.

This article was updated to include a statement from Zoom.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download


Mysterious MacOS spyware discovered using public cloud storage as its control server

Mysterious MacOS spyware discovered using public cloud storage as its control server

22 Jul 2022
How to take a screenshot on MacOS
operating systems

How to take a screenshot on MacOS

18 Jul 2022

Most Popular

Empowering employees to truly work anywhere

Empowering employees to truly work anywhere

22 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Why Japan finds it so hard to digitally transform
digital transformation

Why Japan finds it so hard to digitally transform

1 Dec 2022