Monday, March 10, 2008 9:38 AM cmosby

Acronis True Image Echo Group Server and Windows Agent Denial of Service - Advisories - Secunia

 

Acronis True Image Echo Group Server and Windows Agent Denial of Service

Secunia Advisory:
SA29306

Release Date:
2008-03-10

Critical:

Less critical

Impact:
DoS

Where:
From local network

Solution Status:
Unpatched

Software:
Acronis True Image Echo Enterprise Server 9.x

Description:
Luigi Auriemma has reported some vulnerabilities in Acronis True Image Echo, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An input validation error within the Acronis Group Server component can be exploited to cause the service to crash via a specially crafted packet.

2) A NULL-pointer dereference error within the Acronis True Image Windows Agent component can be exploited to cause the service to crash via a specially crafted packet.

The vulnerabilities are reported in Acronis Group Server version 1.5.19.191 and Acronis True Image Windows Agent version 1.0.0.54 included in Acronis True Image Echo Enterprise Server version 9.5.0.8072. Other versions may also be affected.

Solution:
Restrict network access to the services.

Provided and/or discovered by:
Luigi Auriemma

Original Advisory:
http://aluigi.altervista.org/adv/acrogroup-adv.txt
http://aluigi.altervista.org/adv/acroagent-adv.txt

Source: Acronis True Image Echo Group Server and Windows Agent Denial of Service - Advisories - Secunia

Filed under: , ,

Comments

No Comments