WinZip 'gdiplus.dll' Microsoft Module Unspecified Security Vulnerability

Bugtraq ID:	31485
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 25 2008 12:00AM
Updated:	Sep 30 2008 03:49PM
Credit:	WinZip
Vulnerable:	WinZip WinZip 11.1 WinZip WinZip 11.0 WinZip WinZip 11
Not Vulnerable:	WinZip WinZip 12 WinZip WinZip 11.2 SR-1

WinZip 'gdiplus.dll' Microsoft Module Unspecified Security Vulnerability

WinZip is prone to an unspecified vulnerability that stems from an error in the Microsoft 'gdiplus.dll' component included with the application.

NOTE: The issues described in this BID may be related to one or more of the issues described in the Microsoft MS08-052 security bulletin.

Reports indicate that this issue may allow attackers to execute arbitrary code in the context of the affected application, but Symantec has not confirmed this information.

This issue affects WinZip 11.x (prior to 11.2 SR-1) on Windows 2000 systems.

WinZip 'gdiplus.dll' Microsoft Module Unspecified Security Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WinZip 'gdiplus.dll' Microsoft Module Unspecified Security Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

WinZip 'gdiplus.dll' Microsoft Module Unspecified Security Vulnerability

References:

• WinZip Homepage (WinZip)
  
• Microsoft Security Bulletin MS08-052 (Microsoft)
  
• WinZip 11.2 SR-1 (Build 8261) (WinZip)
  
• WinZip Releases Version 11.2 SR-1 (US-CERT)