|
Acronis True Image Echo Server FTP AES Encryption Security Bypass
|
|
Secunia Advisory:
|
SA30856
|
|
|
Release Date:
|
2008-07-31
|
|
Last Update:
|
2008-11-19
|
|
Popularity:
|
2,500 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Acronis True Image Echo Enterprise Server 9.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Travis C Johnson has discovered a security issue in Acronis True Image Echo Server, which can be exploited by malicious people to disclose sensitive information.
The security issue is caused due to the application not correctly encrypting backups when the backup destination is an FTP server, which can be exploited to disclose sensitive information by e.g. intercepting the transfer.
The security issue is confirmed in Acronis True Image Echo Server build 8072 for Linux. Other versions may also be affected.
Solution:
Update to Acronis True Image Echo Server build 8163.
http://www.acronis.com/enterprise/support/updates/
Provided and/or discovered by:
Travis C Johnson
Changelog:
2008-11-19: Updated "Solution" section.
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
