Unscored CVE-2008-3442 EUVD-2008-3428GHSA-fc6q-rxqx-rpp6

WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code…

Published Aug 1, 2008 · Updated Sep 16, 2024 · Assigned by mitre

Description

WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

References

1020581 vdb-entry
http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
20080728 Tool release: [evilgrade] - Using DNS cache poisoning to exploit poor update implementations mailing-list