CVE-2019-18822

Name of the Vulnerable Software and Affected Versions: ZOOM Call Recording version 6.3.1

Description: A privilege escalation issue allows the user account, which runs the program by default under the callrec account, to elevate privileges to root by abusing the callrec-rs@.service. This service starts the /opt/callrec/bin/rs binary with root privileges, and since this binary is owned by callrec, it can be replaced by a Trojan horse.

Recommendations: For ZOOM Call Recording version 6.3.1, consider restricting access to the callrec-rs@.service to prevent abuse and elevation of privileges to root. As a temporary workaround, monitor the /opt/callrec/bin/rs binary for any unauthorized modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.