The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. This allows a malicious actor to execute arbitrary code with administrator privileges.

The vulnerability of the Acronis True Image backup and recovery software relates to security configuration errors during updates via HTTP. In such updates, only those updates that use the MD5 hash provided by the server are verified. Exploiting this vulnerability allows an attacker to execute...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Code injection

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2017-3219

CVE-2017-3219 affects Acronis True Image up to 2017 Build 8053, which performs software updates over HTTP with updates only verified by a server-provided MD5 hash. This design allows a potential attacker on the same network or able to influence traffic to cause the update process to execute arbit...

CVE-2017-3219: Missing Encryption of Sensitive Data

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

Acronis True Image Man-in-the-Middle Bypass Security Vulnerability

Acronis True Image is a disaster backup and recovery solution from Acronis Switzerland. The solution supports backing up, synchronizing, sharing and storing various types of files. A security vulnerability exists in Acronis True Image that stems from the program's failure to securely detect and...

Acronis True Image fails to update itself securely

Overview Acronis True Image fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges. Description Acronis True Image is a disk backup utility for Windows and Mac systems. Acronis True Image versions through...

PT-2017-2869

Name of the Vulnerable Software and Affected Versions Acronis True Image versions up to and including 2017 Build 8053 Description The issue is related to errors in security settings when updating using HTTP, where downloaded updates are only verified using a server-provided MD5 hash. This could...

Acronis True Image: Backup App - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Acronis True Image: Backup App published at the 'play' market has multiple vulnerabilities...

Acronis True Image Echo Enterprise Server 9.5.0.8072 - Multiple Remote Denial of Service Vulnerabilities

No description provided by source...

CVE-2008-3671

Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-3671

The CVE-2008-3671 entry concerns Acronis True Image Echo Server 9.x build 8072 running on Linux, where backups sent to an FTP server are not properly encrypted. This leads to potential information disclosure by remote attackers. The vulnerability description notes that the provenance is unknown a...

CVE-2008-3671

Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-3671: Undefined Security Weakness

Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Invalid memory access in Acronis True Image Group Server 1.5.19.191

Luigi Auriemma Application: Acronis True Image Group Server http://www.acronis.com/enterprise/products/ATIES/group-server.html Versions: = 1.5.19.191 included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages Platforms: Windows Bug: invalid memory access...

NULL pointer in Acronis True Image Windows Agent 1.0.0.54

Luigi Auriemma Application: Acronis True Image Windows Agent http://www.acronis.com/enterprise/products/ATIES/windows-agent.html Versions: = 1.0.0.54 included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages Platforms: Windows Linux is not affected Bug: NULL...

Out-of-bounds

Acronis True Image Group Server 1.5.19.191 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service crash via a packet with an invalid length field, which causes an out-of-bounds read...

Null pointer dereference

Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service crash via a malformed packet to port 9876, which triggers a NULL pointer dereference...

CVE-2008-1280

Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image packages, allows remote attackers to cause a denial of service crash via a malformed packet to port 9876, which triggers a NULL pointer dereference...