ZDI-24-1234: WinZip Mark-of-the-Web Bypass Vulnerability
This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archive files. When opening an archive that bears the Mark-of-the-Web, WinZip removes the Mark-of-the-Web from the archive file. Following extraction, the extracted files also lack the Mark-of-the-Web. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.
Other sources
This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-8811.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1234?
The severity of ZDI-24-1234 is categorized as a medium risk due to the requirement for user interaction for exploitation.
How do I fix ZDI-24-1234?
To fix ZDI-24-1234, ensure you have the latest version of WinZip installed which addresses this vulnerability.
What does ZDI-24-1234 allow attackers to do?
ZDI-24-1234 allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip.
Is user interaction needed to exploit ZDI-24-1234?
Yes, user interaction is required as the target must visit a malicious page or open a malicious file.
Which software is affected by ZDI-24-1234?
ZDI-24-1234 affects installations of WinZip by WinZip Computing.