Zero-Day Vulnerability in Zoom Affected Windows 7 Users
A zero-day vulnerability affecting the Zoom client for Windows has been discovered that would allow an attacker to execute arbitrary code on remote devices. Only Windows 7 and older OSes were affected, further complicating the situation.
Zoom vulnerabilities pop up constantly, but that”s also likely due in part to the app’s sudden popularity. The COVID-19 pandemic pushed the Zoom app to the forefront, mostly because of permissive default features that allowed people to use it without a premium account.
With so many users actively engaging in videoconferences, it was just a matter of time before Zoom become an active target for hackers and security researchers. Out of all possible problems, zero-day vulnerabilities are the most troublesome.
In this case, it was a vulnerability available only in Windows 7 and older products. Even if these products are no longer supported, it doesn’t mean that they”re not used. In fact, Windows 7 still has a market share of around 5%. Given the large number of PCs out there, that leaves a lot of vulnerable devices.
“The vulnerability allows a remote attacker to execute arbitrary code on victim’s computer where Zoom Client for Windows (any currently supported version) is installed by getting the user to perform some typical action such as opening a document file. No security warning is shown to the user in the course of attack,” said the researchers from 0patch who disclosed the exploit.
For unknown reasons, the researcher who found the problem didn’t want to report the vulnerability to Zoom and left this job to 0patch. Following disclosure, Zoom issued a patch that covered the Windows 7 version.
Unfortunately, it’s only a matter of time before other security issues are found with Windows 7 and its interactions with other software. Since Microsoft no longer supports the OS, the problems will only go away when people stop using that operating system.
August Spam Debrief: Bitdefender Labs Warns of Fraud Campaigns Exploiting the Russia-Ukraine War
August 31, 2022
Snake Keylogger Returns in Malspam Campaign Disguised as Business Portfolio from IT Vendor
August 30, 2022
What is medical identity theft and how to protect against it
July 27, 2022
Identifying and Dealing with Online Bullying Is Not Impossible - School Presentation Inside
June 28, 2022
Let’s Celebrate World Social Media Day by Improving Your Privacy and Security Online
June 28, 2022