No-IP DUC Client for Windows Local Information Disclosure Vulnerability
BID:29758
Info
No-IP DUC Client for Windows Local Information Disclosure Vulnerability
| Bugtraq ID: | 29758 |
| Class: | Access Validation Error |
| CVE: |
CVE-2008-2747 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 16 2008 12:00AM |
| Updated: | May 07 2015 05:28PM |
| Credit: | Charalambous Glafkos, George Nicolaou |
| Vulnerable: |
No-IP Dynamic Update Client 0 |
| Not Vulnerable: | |
Discussion
No-IP DUC Client for Windows Local Information Disclosure Vulnerability
The DUC application for No-IP is prone to a local information-disclosure vulnerability when it is running on Microsoft Windows.
Successfully exploiting this issue allows attackers to obtain potentially sensitive information that may aid in further attacks.
The DUC application for No-IP is prone to a local information-disclosure vulnerability when it is running on Microsoft Windows.
Successfully exploiting this issue allows attackers to obtain potentially sensitive information that may aid in further attacks.
Exploit / POC
No-IP DUC Client for Windows Local Information Disclosure Vulnerability
Attackers use readily available utilities to decode the retrieved information.
The following exploit is available:
Attackers use readily available utilities to decode the retrieved information.
The following exploit is available:
Solution / Fix
No-IP DUC Client for Windows Local Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
No-IP DUC Client for Windows Local Information Disclosure Vulnerability
References:
References: