search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Acronis True Image fails to update itself securely

Vulnerability Note VU#489392

Original Release Date: 2017-06-19 | Last Revised: 2017-06-28

Overview

Acronis True Image fails to securely check for and retrieve updates, which an allow an authenticated attacker to execute arbitrary code with administrator privileges.

Description

Acronis True Image is a disk backup utility for Windows and Mac systems. Acronis True Image versions through and including 2017 Build 8053 performs update operations over unprotected HTTP channels. Downloaded updates are not validated beyond verifying the server-provided MD5 hash.

Impact

An attacker on the same network as, or who can otherwise affect network traffic from, an Acronis True Image user can cause the True Image update process to execute arbitrary code with system administrator privileges.

Solution

Apply an update

This issue is addressed in Acronis True Image 2017 Build 8058. Although the updates are still checked and downloaded over HTTP, the certificate of the downloaded update is verified.

Don't use built-in update capabilities

Because Acronis True Image does not include the ability to securely check for and install updates, any True Image updates should be obtained from https://www.acronis.com/ directly, using your web browser.

Avoid untrusted networks

Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a MITM attack.

Vendor Information

489392
Expand all

Acronis Inc.

Notified:  June 15, 2017 Updated:  June 28, 2017

Status

  Affected

Vendor Statement

Acronis is aware of a minor security issue related to Acronis True Image 2017 (Build 8053 and earlier) that was reported by CERT Coordination Center (CERT/CC) at Carnegie Mellon University's Software Engineering Institute. We immediately fixed the vulnerability, prepared a patch for our newest update, and are currently testing it. Once ready we will notify users of the fix. While the threat to users is considered low-risk since multiple, rare occurrences would need to happen in order for someone to exploit the vulnerability, we will urge all Acronis True Image 2017 customers to apply the patch by opening the application and selecting 𠇌heck for Updates.” We take data protection very seriously, which is why we have acted so quickly to respond to this threat. We are also examining this incident further to ensure no similar vulnerabilities remain in our products.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C
Temporal 7.5 E:POC/RL:U/RC:C
Environmental 5.6 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs: CVE-2017-3219
Date Public: 2017-06-19
Date First Published: 2017-06-19
Date Last Updated: 2017-06-28 20:59 UTC
Document Revision: 12

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.