Thursday, July 31, 2008 4:35 PM
cmosby
Acronis True Image Echo Server FTP AES Encryption Security Bypass - Secunia
Acronis True Image Echo Server FTP AES Encryption Security Bypass
Secunia Advisory:
SA30856
Release Date:
2008-07-31
Critical:
Less critical
Impact:
Exposure of sensitive information
Where:
From remote
Solution Status:
Unpatched
Software:
Acronis True Image Echo Enterprise Server 9.x
Description:
Travis C Johnson has discovered a security issue in Acronis True Image Echo Server, which can be exploited by malicious people to disclose sensitive information.
The security issue is caused due to the application not correctly encrypting backups when the backup destination is an FTP server, which can be exploited to disclose sensitive information by e.g. intercepting the transfer.
The security issue is confirmed in Acronis True Image Echo Server build 8072 for Linux. Other versions may also be affected.
Solution:
Do not rely on the encryption when backing up onto FTP servers.
Create local backups and transfer them manually.
Provided and/or discovered by:
Travis C Johnson
Filed under: Patch Management, Enterprise Applications, Software Vulnerabilites