PT-2003-2321 · Winzip · Winzip

Elisa Flanders + 1 · Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1376

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WinZip version 8.0

Description The issue concerns weak random number generation used for password-protected ZIP files. This weakness allows local users to brute force the encryption keys, enabling them to extract data from the ZIP file by guessing the state of the stream coder.

Recommendations For WinZip version 8.0, consider using an alternative method for encrypting ZIP files until a patch or updated version with improved random number generation is available. As a temporary workaround, avoid using password-protected ZIP files with this version to minimize the risk of data extraction.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2003-1376

Produtos afetados

Winzip

Referências · 5

• 🔥 http://securityfocus.com/archive/1/311059 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1376 · Nota de Segurança
• http://securityreason.com/securityalert/3265 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11296 · Nota
• http://securityfocus.com/bid/6805 · Nota