CVE-2008-3442
01.08.2008, 14:41
WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
| Vendor | Product | Version |
|---|---|---|
| winzip | winzip | 7.0 |
| winzip | winzip | 8.0 |
| winzip | winzip | 8.1 |
| winzip | winzip | 8.1 |
| winzip | winzip | 9.0 |
| winzip | winzip | 9.0 |
| winzip | winzip | 10.0 |
𝑥
= Vulnerable software versions
References