Critical hole through WinZip ActiveX module
Version 10 of the widely distributed Windows compression software WinZip anchors an ActiveX module in the system during installation. Unfortunately, that module contains a security hole. Simply visiting a specially prepared website is all that's needed to compromise the computer.
The WinZip ActiveX module WZFILEVIEW.FileViewCtrl.61, an in-house implementation of the functions of the FileView ActiveX module, allows attackers to plant bugs using rigged websites. During installation, the ActiveX control is marked as "safe for scripting," which instructs Internet Explorer to involve it as needed when requested by a website.
Only users of the WinZip 10 series are affected, as older versions do not contain the ActiveX module. The current version, WinZip 10.0 build 7245, closes the hole. Administrators also have the option of setting the kill bit for the ActiveX component; the CLSID is {A09AE68F-B14D-43ED-B713-BA413F03490}.
- WinZip 10.0 Build 7245, Release notes for the current version of WinZip
- WinZip FileView ActiveX Control Unsafe Method Exposure Vulnerability, bug report from the Zero Day initiative
(ehe)