WinZip Computing Inc. recently revealed that Version 9.0 of its popular WinZip file compression program is vulnerable to a variety of security attacks. The company has released a “Service Release 1” to address the security problems.
The WinZip advisory states that “a number of general internal improvements have been made to the WinZip program to enhance security and reliability.” According to the company, the vulnerabilities were found in the course of an internal review and there is no report that any of the problems have been exploited.
The alert also said that the service release addresses a specific buffer overflow resulting from certain malformed input on the WinZip command line. This problem was reported by a user, who had no information that it has been exploited, the company said.
A WinZip representative told eWEEK.com that earlier versions of the compression utility are also vulnerable to the reported problems and that users should avail themselves of their free upgrade program to move to Service Release 1.
In addition, Service Release 1 adds security warnings when the user attempts to execute some potentially dangerous files from within WinZip.
However, when testing the new Service Release 1, we received a warning when attempting to execute a .EXE file, but not with an .HTML file. WinZip officials stated that many attacks based on zipped HTML files, such as the recent Bagle attack, will only work on Windows XP due to its Compressed (zipped) Folders feature. It causes all the files in the ZIP archive to appear to be in the same folder, allowing them to execute each other.
This isnt the first vulnerability uncovered in WinZip. Earlier in the year, security researchers uncovered a problem with specially designed MIME archives. Once opened, the attack would trick WinZip into executing code contained in the attacking file.
Files handled by WinZip are not normally executable, so many users are less-hesitant to launch them, even when they come from unknown sources. This problem makes those files much more inherently dangerous.
Check out eWEEK.coms Security Center for security news, views and analysis. And for insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:
