PT-2017-2869 · Acronis · Acronis True Image

Will Dormann · Published 2017-06-15 · Updated 2019-10-09 · CVE-2017-3219

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Acronis True Image versions up to and including 2017 Build 8053

Description The issue is related to errors in security settings when updating using HTTP, where downloaded updates are only verified using a server-provided MD5 hash. This could allow an attacker to execute arbitrary code with administrator privileges.

Recommendations For Acronis True Image versions up to and including 2017 Build 8053, consider disabling the automatic update feature via HTTP until a secure update mechanism is implemented. Restrict access to the update module to minimize the risk of exploitation. Avoid using the MD5 hash for update verification; instead, wait for an update that implements a more secure verification method. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-345

CWE-311

CWE-254

Related Identifiers

BDU:2017-02151

CVE-2017-3219

Affected Products

Acronis True Image

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-3219 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3219 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02151 · Security Note
• https://kb.cert.org/vuls/id/489392 · Note
• http://securityfocus.com/bid/99128 · Note