CVE-2008-3442

WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:winzip:winzip:7.0:*:*:*:*:*:*:*
cpe:2.3:a:winzip:winzip:8.0:*:*:*:*:*:*:*
cpe:2.3:a:winzip:winzip:8.1:*:*:*:*:*:*:*
cpe:2.3:a:winzip:winzip:8.1:*:sr1:*:*:*:*:*
cpe:2.3:a:winzip:winzip:9.0:*:*:*:*:*:*:*
cpe:2.3:a:winzip:winzip:9.0:*:sr1:*:*:*:*:*
cpe:2.3:a:winzip:winzip:10.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-08-01 14:41

Updated : 2024-02-04 17:33


NVD link : CVE-2008-3442

Mitre link : CVE-2008-3442

CVE.ORG link : CVE-2008-3442


JSON object : View

Products Affected

winzip

  • winzip
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')