CVE-2008-2747 No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive....
LowCVSS 2.1
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| no-ip dynamic update client | = 2.2.1 | No fix listed |
References
- 30714 third-party-advisory vendor-advisory
- 3952 third-party-advisory
- 20080616 DUC NO-IP Local Password Information Disclosure Vulnerability mailing-list
- 29758 vdb-entry
- noipduc-duc-info-disclosure(43298) vdb-entry