[security-alerts] FW: ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> -----Original Message-----
> From: Brian_Schafer@xxxxxxxx [mailto:Brian_Schafer@xxxxxxxx] 
> On Behalf Of zdi-disclosures@xxxxxxxx
> Sent: Tuesday, November 14, 2006 10:01 PM
> To: full-disclosure@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
> Cc: zdi-disclosures@xxxxxxxx
> Subject: ZDI-06-040: WinZip FileView ActiveX Control Unsafe 
> Method Exposure Vulnerability
> 
> ZDI-06-040: WinZip FileView ActiveX Control Unsafe Method Exposure
>             Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-06-040.html
> November 14, 2006
> 
> -- CVE ID:
> CVE-2006-5198
> 
> -- Affected Vendor:
> WinZip
> 
> -- Affected Products:
> WinZip 10.0 (pre build 7245)
> 
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability since September  5, 2006 by Digital Vaccine protection
> filter ID 4671. For further product information on the 
> TippingPoint IPS:
> 
>     http://www.tippingpoint.com 
> 
> -- Vulnerability Details:
> This vulnerability allows remote attackers to execute 
> arbitrary code on
> systems with vulnerable installations of WinZip. User interaction is
> required to exploit this vulnerability in that the target must visit a
> malicious page.
> 
> The specific flaw exists within the ActiveX control
> WZFILEVIEW.FileViewCtrl.61, CLSID:
> 
>     A09AE68F-B14D-43ED-B713-BA413F034904
> 
> A re-branded version of the "FileView" ActiveX control 
> developed by Sky
> Software. The object is marked "Safe for Scripting" and 
> exposes several
> unsafe methods which can be leveraged to result in arbitrary code
> execution with no further interaction.
> 
> -- Vendor Response:
> WinZip has issued build 7245 to correct this vulnerability. 
> More details
> can be found at:
> 
> http://www.winzip.com/wz7245.htm
> 
> -- Disclosure Timeline:
> 2006.08.28 - Vulnerability reported to vendor
> 2006.09.05 - Digital Vaccine released to TippingPoint customers
> 2006.11.14 - Coordinated public release of advisory
> 
> -- Credit:
> This vulnerability was discovered by an anonymous researcher.
> 
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, a division of 3Com, The Zero Day 
> Initiative
> (ZDI) represents a best-of-breed model for rewarding security
> researchers for responsibly disclosing discovered vulnerabilities.
> 
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
> 
>     http://www.zerodayinitiative.com
> 
> The ZDI is unique in how the acquired vulnerability 
> information is used.
> 3Com does not re-sell the vulnerability details or any exploit code.
> Instead, upon notifying the affected product vendor, 3Com provides its
> customers with zero day protection through its intrusion prevention
> technology. Explicit details regarding the specifics of the
> vulnerability are not exposed to any parties until an official vendor
> patch is publicly available. Furthermore, with the altruistic aim of
> helping to secure a broader user base, 3Com provides this 
> vulnerability
> information confidentially to security vendors (including competitors)
> who have a vulnerability protection or mitigation product.
>