Skip to content
OpenAdvisories
Medium WID-SEC-2024-1779 6 CVEs

ZScaler Client Connector: Mehrere Schwachstellen

Published Aug 6, 2024 · Updated Aug 6, 2024 · de-DE

Vendor: Zscaler Product: Client Connector Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in ZScaler Client Connector ausnutzen, um Sicherheitsvorkehrungen zu umgehen, erhöhte Rechte zu erlangen und beliebigen Code auszuführen.

Product

Zscaler Client Connector, ehemals Zscaler App (Z App) führt Sicherheits- und Richtlinienkontrollen auf verwalteten Endgeräten durch.

Vulnerabilities 6

  • High 7.8
    CVE-2024-23456

    Signature validation issue leads to Anti-Tampering bypass

    Anti-tampering can be disabled under certain conditions without signature validation. This affects Zscaler Client Connector <4.2.0.190 with anti-tampering enabled.

    Zscaler Client Connector
  • High 7.3
    CVE-2024-23458

    Local Privilege Escalation on Zscaler Client Connector on Windows

    While copying individual autoupdater log files, reparse point check was missing which could result into crafted attacks, potentially leading to a local privilege escalation. This issue affects Zscaler Client Connector on Windows <4.2.0.190.

    Zscaler Client Connector
  • High 7.2
    CVE-2024-23464

    Zscaler bypass with administrative privileges on Windows

    In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1

    Zscaler Client Connector
  • High 7.0
    CVE-2024-23483

    Local Privilege Escalation via lack of input validation

    An Improper Input Validation vulnerability in Zscaler Client Connector on MacOS allows OS Command Injection. This issue affects Zscaler Client Connector on MacOS <4.2.

    Zscaler Client Connector
  • Medium 6.4
    CVE-2024-23460

    Incorrect signature validation of package

    The Zscaler Updater process does not validate the digital signature of the installer before execution, allowing arbitrary code to be locally executed. This affects Zscaler Client Connector on MacOS <4.2.

    Zscaler Client Connector
  • Medium 5.7
    CVE-2023-28806

    Signature validation error in DLL allows disabling anti-tampering protection

    An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190.

    Zscaler Client Connector

Revision history

  1. #1

    Initiale Fassung

References