Server-client communication in certain versions of the WinZip file compression tool is insecure and could be modified to deliver malicious content to users.
WinZip is a long-standing utility for Windows users with file archiving needs beyond the support built into the operating system.
The tool, which was originally released about 30 years ago, now has versions for macOS, Android , and iOS, as well as an enterprise version that adds collaboration features. According to its website, the app has been downloaded more than a billion times.
WinZip is currently at version 25, but previous versions check the server for updates over an unencrypted connection, a weakness that a hacker could exploit.
Martin Rakhmanov of Trustwave SpiderLabs detected traffic from a vulnerable version of the tool to show this unencrypted communication.
Given the insecure nature of the communication channel, Rakhmanov says that traffic can be "stolen, manipulated, or hijacked" by an attacker on the same network as the WinZip user.
One risk that arises from this action is DNS poisoning, which tricks the application into retrieving a fake update from a malicious web server.
"As a result, the unsuspecting user can launch arbitrary code as if it were a valid update," Rakhmanov notes in a post today.
In vulnerable versions of WinZip, an attacker could obtain some potentially sensitive information, such as the user name and registration password.
Rakhmanov says that cleartext communication is also used to display pop-ups that inform users running the free trial version of WinZip how much time they have left for testing.
The content in the pop-up window is HTML retrieved by JavaScript. This allows an attacker on the network to expose users to arbitrary content that appears to come directly from WinZip's servers.
The researcher says that this scenario also comes with the risk of executing arbitrary code on the victim, because WinZip offers some "powerful" APIs in JavaScript.
In WinZip version 25, cleartext communication is not supported. Users to upgrade to the latest version of the application.
However, many users can't get the current version because upgrades are paid. The standard WinZip costs $35.64 and the Pro version costs $59.44.
If upgrading the software is not an option, users are advised to disable update checks.
Source: bleepingcomputer.com
