Shoutbox

I meant more in the way of an attacker could manipulate the packets in order to exploit a vulnerability in either the Wininit library or in Plus! itself. It does not matter that the connection closes at the end of the request, as a man in the middle attack using ARP/DNS spoofing allows the attacker to manipulate both sides of the connection (client end and server end) for the entire duration of the connection.

The sound reference was regarding hypothetical vulnerabilities in the sound library. If a vulnerability was found it would not be hard to send a malformed sample that exploited the vulnerability directly to the server, thus owning the client box.

Edit: Furthermore, there is no way to tell if someone has ARP spoofed your update connection in order to download malware to your machine. Even if you force people to download directly from your website (open their browser to the URL of the update page) an attacker can just spoof the DNS and host a fake page himself that contains a Plus! installer with malware attached.