PT-2003-2321 · Winzip · Winzip

Elisa Flanders + 1 · Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1376

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WinZip version 8.0

Description The issue concerns weak random number generation used for password-protected ZIP files. This weakness allows local users to brute force the encryption keys, enabling them to extract data from the ZIP file by guessing the state of the stream coder.

Recommendations For WinZip version 8.0, consider using an alternative method for encrypting ZIP files until a patch or updated version with improved random number generation is available. As a temporary workaround, avoid using password-protected ZIP files with this version to minimize the risk of data extraction.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2003-1376

Affected Products

Winzip

References · 5

• 🔥 http://securityfocus.com/archive/1/311059 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1376 · Security Note
• http://securityreason.com/securityalert/3265 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11296 · Note
• http://securityfocus.com/bid/6805 · Note