The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
WinZip Multiple Buffer Overflows
------------------------------------------------------------------------
SUMMARY
<http://www.winzip.com/> WinZip is an archiving utility for the Microsoft
Windows platform featuring built-in support for CAB files and for popular
Internet file formats such as TAR, gzip, UUencode, BinHex, and MIME. ARJ,
LZH, and ARC files are supported via external programs.
New vulnerabilities were found in WinZip, including buffer overflows in
various portions of code and in command line argument parsing. The
vulnerabilities in question can easily lead to arbitrary code execution.
DETAILS
Vulnerable Systems:
* WinZip versions 9.0 and prior
Immune Systems:
* WinZip version 9.0 SR-1
A few unspecified buffer overflows were found in WinZip while performing
an internal code audit. Another buffer overflow was found when a specially
crafted command line was used.
Impact
Zip files are used almost everywhere and are extremely widespread.
Considering this and the fact that almost any Win32 based system contains
a vulnerable version of WinZip, almost every system is prone to attack.
All an attacker has to do is to either exploit one of the overflow
conditions inherent in the code by providing a special zip file or by
somehow launching winzip with a specially crafted command line. Both of
these attacks are very possible and pose a serious threat to any Windows
users.
Vendor Status:
The vendor has been contacted and a fix is already available for download
at <http://www.winzip.com/upgrade.htm> http://www.winzip.com/upgrade.htm.
Users of WinZip are highly encouraged to upgrade their WinZip version to
the newer, immune version.
ADDITIONAL INFORMATION
The information has been provided by <mailto:toounrealuk@hotmail.com>
Matt H.
The original article can be found at:
<http://www.securitytracker.com/alerts/2004/Sep/1011132.html>
http://www.securitytracker.com/alerts/2004/Sep/1011132.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
