Mahalo to everybody who came to my @defcon talk "You're M̶u̶t̶e̶d̶ Rooted" 🙏🏽
Was stoked to talk about (& live-demo 😅) a local priv-esc vulnerability in Zoom (for macOS).
Currently there is no patch 👀😱
Slides with full details & PoC exploit:
speakerdeck.com/patrickwardle/… #0day
Was stoked to talk about (& live-demo 😅) a local priv-esc vulnerability in Zoom (for macOS).
Currently there is no patch 👀😱
Slides with full details & PoC exploit:
speakerdeck.com/patrickwardle/… #0day
🆕 Update(s):
🐛 Bug assigned CVE-2022-28756
🩹 Patch now available, in Zoom v5.11.5 (9788)
See Zoom's security bulletin:
explore.zoom.us/en/trust/secur…
Mahalos to @Zoom for the (incredibly) quick fix! 🙌🏽 🙏🏽
🐛 Bug assigned CVE-2022-28756
🩹 Patch now available, in Zoom v5.11.5 (9788)
See Zoom's security bulletin:
explore.zoom.us/en/trust/secur…
Mahalos to @Zoom for the (incredibly) quick fix! 🙌🏽 🙏🏽
Reversing the patch, we see the Zoom installer now invokes lchown to update the permissions of the update .pkg, thus preventing malicious subversions 🔐👍🏽
• • •
Missing some Tweet in this thread? You can try to
force a refresh
