Security analysts on Friday reported that versions of the popular ZIP file management program WinZip have a serious security flaw. According to security intelligence firm iDefense Inc., an error in the parameter parsing code in these versions "allows remote attackers to execute arbitrary code." The attacker would have to construct a specially designed MIME archive (with one of .mim, .uue, .uu, .b64, .bhx, .hqx and .xxe extensions) and distribute the file users, the company explained.
Once opened, the attack would trick WinZip into executing code contained in the attacking file. iDefense said it had a functioning proof-of-concept attack demonstrating the problem. The malicious file could be distributed by e-mail, on a Web page, or through peer-to-peer networks. Files handled by WinZip are not normally executable, so many users are less-hesitant to launch them, even when they come from unknown sources. This problem makes those files much more inherently dangerous.