Description
No-IP Dynamic Update Client (DUC) 2.2.1 on Windows uses weak permissions for the HKLM\SOFTWARE\Vitalwerks\DUC registry key, which allows local users to obtain obfuscated passwords and other sensitive information by reading the (1) TrayPassword, (2) Username, (3) Password, and (4) Hosts registry values.
References
- 29758 vdb-entry
- 30714 third-party-advisory
- 3952 third-party-advisory
- 20080616 DUC NO-IP Local Password Information Disclosure Vulnerability mailing-list
- noipduc-duc-info-disclosure(43298) vdb-entry