CVE-2020-6110: 
NixOS vulnerability analysis and mitigation

An exploitable partial path traversal vulnerability was discovered in Zoom Client version 4.6.10, identified as CVE-2020-6110. The vulnerability exists in how the application processes messages containing shared code snippets. This security flaw could allow an attacker to achieve arbitrary code execution through specially crafted chat messages (Talos Intelligence, Hacker News).

The vulnerability stems from Zoom's chat functionality, which is built on top of the XMPP standard with additional extensions. When processing code snippets, the application creates a zip archive but fails to validate its contents before extraction. The flaw includes a partial path traversal issue that allows specially crafted zip files to write files outside the intended randomly generated directory. The vulnerability received a CVSS v3.0 score of 8.0 (HIGH) with the vector CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H and is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (Talos Intelligence).

The vulnerability could be exploited in two scenarios: without user interaction, attackers could plant arbitrary binaries on the target system at a constrained path, potentially useful for exploiting other vulnerabilities. With user interaction, attackers could plant binaries at almost arbitrary paths, potentially overwriting important files and leading to arbitrary code execution (Talos Intelligence).

An attacker needs to send a specially crafted message to a target user or group to trigger this vulnerability. The attack can be executed through chat messages containing malicious code snippets. While the feature to send code snippets requires an additional plugin, receiving them does not require any special configuration (Talos Intelligence).

The vulnerability was patched in Zoom version 4.6.12. Users should upgrade to this version or later to protect against this security flaw. The issue was confirmed to affect versions 4.6.10 and 4.6.11 (and likely prior versions) (Talos Intelligence).