[NT] WinZip Multiple Buffer Overflows
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 6 Sep 2004 13:02:24 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
WinZip Multiple Buffer Overflows
<http://www.winzip.com/> WinZip is an archiving utility for the Microsoft
Windows platform featuring built-in support for CAB files and for popular
Internet file formats such as TAR, gzip, UUencode, BinHex, and MIME. ARJ,
LZH, and ARC files are supported via external programs.
New vulnerabilities were found in WinZip, including buffer overflows in
various portions of code and in command line argument parsing. The
vulnerabilities in question can easily lead to arbitrary code execution.
* WinZip versions 9.0 and prior
* WinZip version 9.0 SR-1
A few unspecified buffer overflows were found in WinZip while performing
an internal code audit. Another buffer overflow was found when a specially
crafted command line was used.
Zip files are used almost everywhere and are extremely widespread.
Considering this and the fact that almost any Win32 based system contains
a vulnerable version of WinZip, almost every system is prone to attack.
All an attacker has to do is to either exploit one of the overflow
conditions inherent in the code by providing a special zip file or by
somehow launching winzip with a specially crafted command line. Both of
these attacks are very possible and pose a serious threat to any Windows
The vendor has been contacted and a fix is already available for download
at <http://www.winzip.com/upgrade.htm> http://www.winzip.com/upgrade.htm.
Users of WinZip are highly encouraged to upgrade their WinZip version to
the newer, immune version.
The information has been provided by <mailto:email@example.com>
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.