Adr

**Name of the Vulnerable Software and Affected Versions** Acronis True Image version 2021 **Description** The issue concerns an OpenSSL component in Acronis True Image 2021, where the OPENSSLDIR variable is specified as a subdirectory within C:jenkins agent. This component is used by a privileged service within Acronis True Image. An unprivileged Windows user can create subdirectories off the system root, potentially allowing the creation of a specially-crafted openssl.cnf file. This could lead to arbitrary code execution with SYSTEM privileges. **Recommendations** For Acronis True Image version 2021, consider restricting access to the system root to prevent unprivileged users from creating subdirectories that could be used to exploit this issue. As a temporary workaround, restrict the use of the OpenSSL component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acronis True Image version 2021 **Description** The issue arises from improper ACL settings of the C:ProgramDataAcronis directory by Acronis True Image 2021. This allows an unprivileged user to execute arbitrary code with SYSTEM privileges by placing a DLL in specific paths within C:ProgramDataAcronis. **Recommendations** For Acronis True Image version 2021, as a temporary workaround, consider restricting access to the C:ProgramDataAcronis directory to prevent unprivileged users from placing malicious DLLs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Acronis Cyber Backup versions 12.5 Acronis Cyber Protect version 15 **Description** The issue concerns an OpenSSL component in Acronis Cyber Backup and Cyber Protect that specifies an OPENSSLDIR variable as a subdirectory within C:jenkins agent. This component is used by a privileged service in these products. Unprivileged Windows users can create subdirectories off of the system root, allowing a user to create a path to a specially-crafted openssl.cnf file. This can lead to arbitrary code execution with SYSTEM privileges. **Recommendations** For Acronis Cyber Backup version 12.5, consider disabling the privileged service that uses the OpenSSL component until a patch is available. For Acronis Cyber Protect version 15, restrict access to the subdirectory within C:jenkins agent to minimize the risk of exploitation. Avoid using the `OPENSSLDIR` variable in the affected OpenSSL component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 2.6.10 through 2.6.13 **Description** The issue allows local users to enable debugging and obtain sensitive information due to a debug file in sysfs being created with world-readable and world-writable permissions. **Recommendations** For Linux kernel versions 2.6.10 through 2.6.13, consider restricting access to the debug file in sysfs to prevent local users from enabling DRM debugging and obtaining sensitive information.