FYI: CERT: Acronis True Image fails to update itself securely
"Vulnerability Note VU#489392
Original Release date: 19 Jun 2017 | Last revised: 19 Jun 2017
Acronis True Image fails to update itself securely
Overview
Acronis True Image fails to securely check for and retrieve updates, which [c]an[sic] allow an authenticated attacker to execute arbitrary code with administrator privileges.
Description
|
... Acronis True Image versions through and including 2017 Build 8053 performs update operations over unprotected HTTP channels. Downloaded updates are not validated beyond verifying the server-provided MD5 hash. |
Impact
|
An attacker on the same network as, or who can otherwise affect network traffic from, an Acronis True Image user can cause the True Image update process to execute arbitrary code with system administrator privileges. |
Solution
|
The CERT/CC is currently unaware of a practical solution to this problem. Please consider the following workarounds: |
|
Don't use built-in update capabilities Because Acronis True Image does not include the ability to securely check for and install updates, any True Image updates should be obtained from https://www.acronis.com/ directly, using your web browser. Avoid untrusted networks Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a MITM attack." |
Good Work Steve :-) Thanks.
Hopefully, he/she will not first have learned about this from your PM.
The vulnerability, with a CVSS base score of 8.3, is ranked as being of "High severity" by CERT.
I can hear pins dropping :-(
But upon reflection, this is really no big deal PROVIDED THAT AN ATI USER KNOWS ABOUT IT -- updating via downloading updates from the website rather than through the program is only a trivial inconvenience.
Updating by independently downloading major updates from a vendor website is a method occasionally used by major players in the security program sector, e.g., Norton and Kaspersky. It's not like ATI updates are all that frequent.
From CERT Website:
Acronis Inc. Information for VU#489392
Acronis True Image fails to update itself securely
- Vendor Information Help Date Notified: 15 Jun 2017
- Statement Date:
- Date Updated: 19 Jun 2017
Status
Affected
Vendor Statement
No statement is currently available from the vendor regarding this vulnerability.
Vendor Information
From Acronis support:
I would like to inform you that Acronis application will not get automatically updated.
If there is any new update is available, Acronis will notify you and you can update the application.
If you are not in trusted network, then you can click on cancel for the update and when
you have trusted network then you go ahead and update to the latest build.
You can also download the latest build from your Acronis account and can update the application.
Please refer to the knowledge-base article link in order to download installation file from Acronis account:
https://kb.acronis.com/content/2900
http://www.kb.cert.org/vuls/id/CHEU-ANCLQZ
Not exactly sure what this statement "From Acronis Support" is supposed to represent but although I might be blind, I have read https://kb.acronis.com/content/2900 and have not seen this language and furthermore it does not appear to be a fully satisfactory statement. From The CERT description of the vulnerability it is not entirely clear that being in a "Trusted Network" offers total protection from this vulnerability -- what is the precise meaning of a "Trusted Network" for purposes of preventing an attack from this vulnerability. The CERT report states that avoiding untrusted networks WILL ONLY LESSEN the chances of cgetting dinged by this vulnerability.
Is there something inherent in the architecture of ATI that prevents making internal updates over a secure connection???
Acronis Sales/Marketing is lucky that this vulnerability has not been widely reported. I have only seen it on the CERT site and on one security forum.
How many ATI users who do not frequent this forum know of it???
Trusted networks are those that are operating over secure connections. I believe that Acronis update servers are run on trusted (secure) networks. Public networks are not trusted networks because they use an open shared connection. Running any update including Microsoft Windows update on public networks has the potential of vulnerability to MITM attack.
The above is a WiFi (wireless) network connection. A private wireless connection that is secured with encryption keys does not suffer from this vulnerability. Wired networks do have the same vulnerability if running SMB 1.0. Those running SMB 3.0 have the latest security availible to defend against MITM attacks.
In reply to Trusted networks are those… by truwrikodrorow…
Enchantech :-) Thanks for that.
FYI:
"Hi all,
My name is Katya, VP of communications at Acronis.
Here is our official comment about it[the vulnerability in th einternal update process]:
Acronis is aware of a minor security issue related to Acronis True Image (versions 2017 Build 8053 and earlier) that was reported by our colleagues at CERT Coordination Center (CERT/CC) at Carnegie Mellon University's Software Engineering Institute.
We immediately fixed the vulnerability, prepared a patch for our newest update, and are currently notifying users of the issue.
While the threat to users is considered low-risk since multiple, rare occurrences would need to happen in order for someone to exploit the vulnerability, we are urging all Acronis True Image customers to apply the patch by opening the application and selecting “Check for Updates.”
Acronis takes data protection very seriously, which is why we have acted so quickly to respond to this threat. We will examine this incident further to ensure no similar vulnerabilities exist in our products."
https://www.wilderssecurity.com/threads/acronis-true-image-fails-to-upd…
thunderhawk, thanks again for posting the above update - I have to admit to being a little puzzled myself by Katya's comments about a patch being available for this vulnerability as there is nothing being shown when checking for updates within the application, or being shown on the Acronis Product Updates page which shows the latest updates (builds) were released in April 2017.
Hello Everyone,
a security update for Acronis True Image New Generation – Update 2 is already available for download.
Build number for Windows: 6209
A new build fixes the issue related to the updates download process through the insecure channel. In addition to verifying the server-provided MD5 hash, Acronis digital signature validation was added. For more information read here: https://kb.acronis.com/content/59916
Security updates for Acronis True Image 2017 Standard version and Acronis True Image 2016 will be published later and announced separately.
Thank you,
Thanks Ekaterina, currently updating to build 6209 for NGen, and can see build 8058 on the Product Updates webpage for the Standard version of 2017.
UPD:
Security updates for Acronis True Image 2017 Standard and Acronis True Image 2016 have been published.
Acronis True Image 2017 (Standard) - Build number for Windows: 8058
Acronis True Image 2016 (Update 4) - Build number for Windows: 6595
Link to the release notes: https://www.acronis.com/en-us/support/updates/changes.html?p=39733
The corresponding article updated: https://kb.acronis.com/content/59916