Acronis True Image fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges.
Acronis True Image is a disk backup utility for Windows and Mac systems. Acronis True Image versions through and including 2017 Build 8053 performs update operations over unprotected HTTP channels. Downloaded updates are not validated beyond verifying the server-provided MD5 hash.
An attacker on the same network as, or who can otherwise affect network traffic from, an Acronis True Image user can cause the True Image update process to execute arbitrary code with system administrator privileges.
Apply an update
This issue is addressed in Acronis True Image 2017 Build 8058. Although the updates are still checked and downloaded over HTTP, the certificate of the downloaded update is verified.
Don't use built-in update capabilities
Because Acronis True Image does not include the ability to securely check for and install updates, any True Image updates should be obtained from <https://www.acronis.com/> directly, using your web browser.
Avoid untrusted networks
Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a MITM attack.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Notified: June 15, 2017 Updated: June 28, 2017
Acronis is aware of a minor security issue related to Acronis True Image 2017 (Build 8053 and earlier) that was reported by CERT Coordination Center (CERT/CC) at Carnegie Mellon University's Software Engineering Institute. We immediately fixed the vulnerability, prepared a patch for our newest update, and are currently testing it. Once ready we will notify users of the fix. While the threat to users is considered low-risk since multiple, rare occurrences would need to happen in order for someone to exploit the vulnerability, we will urge all Acronis True Image 2017 customers to apply the patch by opening the application and selecting 𠇌heck for Updates.” We take data protection very seriously, which is why we have acted so quickly to respond to this threat. We are also examining this incident further to ensure no similar vulnerabilities remain in our products.
Group | Score | Vector
Base | 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal | 7.5 | E:POC/RL:U/RC:C
Environmental | 5.6 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
CVE IDs: | CVE-2017-3219
Date Public: | 2017-06-19
Date First Published: | 2017-06-19
Date Last Updated: | 2017-06-28 20:59 UTC
Document Revision: | 12