Acronis True Image fails to update itself securely

Overview

Acronis True Image fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges.

Description

Acronis True Image is a disk backup utility for Windows and Mac systems. Acronis True Image versions through and including 2017 Build 8053 performs update operations over unprotected HTTP channels. Downloaded updates are not validated beyond verifying the server-provided MD5 hash.

---

Impact

An attacker on the same network as, or who can otherwise affect network traffic from, an Acronis True Image user can cause the True Image update process to execute arbitrary code with system administrator privileges.

---

Solution

Apply an update

This issue is addressed in Acronis True Image 2017 Build 8058. Although the updates are still checked and downloaded over HTTP, the certificate of the downloaded update is verified.

---

Don’t use built-in update capabilities

Because Acronis True Image does not include the ability to securely check for and install updates, any True Image updates should be obtained from <https://www.acronis.com/&gt; directly, using your web browser.

Avoid untrusted networks

Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a MITM attack.

---

Vendor Information

489392

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Acronis Inc. __ Affected

Notified: June 15, 2017 Updated: June 28, 2017

Status

Affected

Vendor Statement

Acronis is aware of a minor security issue related to Acronis True Image 2017 (Build 8053 and earlier) that was reported by CERT Coordination Center (CERT/CC) at Carnegie Mellon University’s Software Engineering Institute. We immediately fixed the vulnerability, prepared a patch for our newest update, and are currently testing it. Once ready we will notify users of the fix. While the threat to users is considered low-risk since multiple, rare occurrences would need to happen in order for someone to exploit the vulnerability, we will urge all Acronis True Image 2017 customers to apply the patch by opening the application and selecting 𠇌heck for Updates.” We take data protection very seriously, which is why we have acted so quickly to respond to this threat. We are also examining this incident further to ensure no similar vulnerabilities remain in our products.

CVSS Metrics

Group	Score	Vector
Base	8.3	AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal	7.5	E:POC/RL:U/RC:C
Environmental	5.6	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <https://www.acronis.com/&gt;
• <https://kb.acronis.com/content/2900&gt;

Acknowledgements

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2017-3219
Date Public:	2017-06-19 Date First Published: