Luigi Auriemma has reported some vulnerabilities in Acronis True Image Echo, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) An input validation error within the Acronis Group Server component can be exploited to cause the service to crash via a specially crafted packet.

2) A NULL-pointer dereference error within the Acronis True Image Windows Agent component can be exploited to cause the service to crash via a specially crafted packet.

The vulnerabilities are reported in Acronis Group Server version 1.5.19.191 and Acronis True Image Windows Agent version 1.0.0.54 included in Acronis True Image Echo Enterprise Server version 9.5.0.8072. Other versions may also be affected.

Solution
Restrict network access to the services.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/acrogroup-adv.txt
http://aluigi.altervista.org/adv/acroagent-adv.txt

Deep Links
Links available in Customer Area