PT-2008-4187 · Vitalwerks · No-Ip Dynamic Update Client

Published 2008-06-18 · Updated 2018-10-11 · CVE-2008-2747

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions No-IP Dynamic Update Client (DUC) version 2.2.1

Description The issue concerns weak permissions for a specific registry key, allowing local users to access sensitive information. This includes obtaining obfuscated passwords and other data by reading the TrayPassword, Username, Password, and Hosts registry values.

Recommendations For No-IP Dynamic Update Client (DUC) version 2.2.1, consider restricting access to the HKLMSOFTWAREVitalwerksDUC registry key to prevent local users from reading sensitive information. As a temporary workaround, restrict access to the TrayPassword, Username, Password, and Hosts registry values until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-2747

Affected Products

No-Ip Dynamic Update Client

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-2747 · Security Note
• http://secunia.com/advisories/30714 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43298 · Note
• http://securityreason.com/securityalert/3952 · Note
• http://securityfocus.com/archive/1/493367/100/0/threaded · Note
• http://securityfocus.com/bid/29758 · Note