Pre-auth Null pointer crash in on-premise web console

  • ZSB-21014
  • CVE-2021-34418
  • Medium
  • 4
  • CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The login service of the web console for the products listed in the “Affected Products” section of this bulletin, fails to validate that a NULL byte was sent while authenticating. This could lead to a crash of the login service.

  • Zoom On-Premise Meeting Connector Controller before version 4.6.239.20200613
  • Zoom On-Premise Meeting Connector MMR before version 4.6.239.20200613
  • Zoom On-Premise Recording Connector before version 3.8.42.20200905
  • Zoom On-Premise Virtual Room Connector before version 4.4.6344.20200612
  • Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5492.20200616

Reported by Jeremy Brown

Revision Date Description
1.0 11/09/2021

Initial Publication