Bug #2585
FreeDNS.afraid.org DDNS client sends in clear text
| Status: | New | Start date: | 08/09/2012 | |
|---|---|---|---|---|
| Priority: | Normal | Due date: | ||
| Assignee: | - | % Done: | 0% |
|
| Category: | DynDNS | |||
| Target version: | - | |||
| Affected version: | All | Affected Architecture: | All |
Description
FreeDNS.afraid.org DDNS client sends the "Authentication Token" (update URL) in clear text. The FreeDNS.afraid.org website warns of unauthorized access to the update URL.
The code affected in dyndns.class file:
case 'freedns':
$needIP = FALSE;
curl_setopt($ch, CURLOPT_URL, 'http://freedns.afraid.org/dynamic/update.php?' . $this->_dnsPass);
Thanks (and sorry for my bad English).