PT-2008-2872 · Acronis · Acronis True Image Enterprise Server+1

Publicado 2008-03-10 · Atualizado 2018-10-11 · CVE-2008-1280

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Acronis True Image Windows Agent version 1.0.0.54 and earlier Acronis True Image Enterprise Server version 9.5.0.8072 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a malformed packet to port 9876. This action triggers a NULL pointer dereference.

Recommendations For Acronis True Image Windows Agent version 1.0.0.54 and earlier, update to a version later than 1.0.0.54 to resolve the issue. For Acronis True Image Enterprise Server version 9.5.0.8072 and earlier, update to a version later than 9.5.0.8072 to resolve the issue. As a temporary workaround, consider restricting access to port 9876 to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-1280

Produtos afetados

Acronis True Image Enterprise Server

Acronis True Image Windows Agent

Referências · 7

• http://aluigi.altervista.org/adv/acroagent-adv.txt · Nota
• http://secunia.com/advisories/29306 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41070 · Nota
• http://securityfocus.com/bid/28169 · Nota
• http://securityfocus.com/archive/1/489362/100/0/threaded · Nota
• http://vupen.com/english/advisories/2008/0812/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1280 · Nota de Segurança