Vulnerability Details CVE-2008-3442
WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 69.7%
CVSS Severity
CVSS v2 Score 7.5
References
- http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html
- http://securitytracker.com/id?1020581
- http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
- http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
- http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html
- http://securitytracker.com/id?1020581
- http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
- http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
Products affected by CVE-2008-3442
-
cpe:2.3:a:winzip:winzip:10.0
-
cpe:2.3:a:winzip:winzip:7.0
-
cpe:2.3:a:winzip:winzip:8.0
-
cpe:2.3:a:winzip:winzip:8.1
-
cpe:2.3:a:winzip:winzip:9.0