Following my answer. If I can list contents of a password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then should ZIP files be still treated as secure?

This is completely insecure in terms of social engineering / influence etc.

I can hijack (intercept) someone else's file (password-protected ZIP file) and I can replace one of the files it contains, with my one (fake, virus) without knowing the password. Replaced file will remain unencrypted, not password-protected inside the 
ZIP, but other files won't be modified.

If a victim unpacks a password-protected archive, extracting program will ask for the password only once, not every time per each file. So end user will not see the difference -- whether the program does not ask for a password, because it already knows it (original file) or because the file being extracted doesn't need a password (file modified by me). This way, I can inject something really bad into a password-protected ZIP file, without knowing its password and count on the receiver assuming the file is unmodified.

Am I missing something or is this really wrong? What can we say about the security terms of a solution, if password is not required to introduce any modification in a password-protected file?

To answer this, there needs to be a better definition of "secure" and/or "safe".  It's always got to be defined in light of the purpose of the protection and the risk to the system.  There's no one size fits all here, what's "safe enough" for one system, may be abysmally weak on another.  And what's "safe enough" on another may be cost prohibitive or down right impractical in a different case.

So, taking the typical concerns one by one:


Confidentiality - marginal at best.  Confidentiality is usually rated in terms of how long it will take to gain access to the protected material.  I may be able to change the zip file, but as a hacker it'll take me some amount of time either crack the password or brute force it.  Not a lot of time, passwords are one of the weaker protections, and given the way zip files are often shared, social engineering one's way to the password is usually not hard.  
Integrity - nope - as the asker points out - it's easy to change the package and make it look legitimate. 
Availability - generally not applicable to this sort of security control - this usually refers to the risk of making a service unavailable - the data storing/packaging usually doesn't affect availability one way or the other.
Non repudiation - nope, no protection - anyone can modify the package, so anyone contributing to it has probable deniability.


The trick is - how much better do you want to get?  Encrypted email is an option - as a better protection.  Although it poses it's own connectivity concerns.  And there's many better ways to encrypt data - but the better options also involve key distribution challenges that can add time and cost concerns.  

As a quick way to package and share some data that you don't want to make completely public - it's better than nothing, and it's sometimes the only common denominator you can work out.  For anything high-risk, I'd find a better option.
