PT-2008-4187 · Vitalwerks · No-Ip Dynamic Update Client

Publicado 2008-06-18 · Atualizado 2018-10-11 · CVE-2008-2747

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions No-IP Dynamic Update Client (DUC) version 2.2.1

Description The issue concerns weak permissions for a specific registry key, allowing local users to access sensitive information. This includes obtaining obfuscated passwords and other data by reading the TrayPassword, Username, Password, and Hosts registry values.

Recommendations For No-IP Dynamic Update Client (DUC) version 2.2.1, consider restricting access to the HKLMSOFTWAREVitalwerksDUC registry key to prevent local users from reading sensitive information. As a temporary workaround, restrict access to the TrayPassword, Username, Password, and Hosts registry values until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-2747

Produtos afetados

No-Ip Dynamic Update Client

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/43298 · Nota
• http://securityreason.com/securityalert/3952 · Nota
• http://securityfocus.com/archive/1/493367/100/0/threaded · Nota
• http://securityfocus.com/bid/29758 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2747 · Nota de Segurança
• http://secunia.com/advisories/30714 · Aviso do Fabricante