QID 376220

QID 376220: Acronis Cyber Protect Arbitrary Code Execution Vulnerability

Acronis Cyber Protect is the only solution that natively integrates cybersecurity, data protection, and management to protect endpoints, systems, and data.

Acronis Cyber Protect includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. It contains a privileged service that uses this OpenSSL component.
Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted OpenSSL.cnf file to achieve arbitrary code execution with SYSTEM privileges.

Affected Version:
Cyber Protect 15

QID Detection Logic:(Authenticated)
This QID checks for display version from registry settings and also checks the existence of the application file cyber-protect-service.exe

Successful exploitation of this vulnerability can lead to arbitrary code execution with SYSTEM privileges.

CVSS V3 rated as High - 7.8 severity.

CVSS V2 rated as High - 7.2 severity.

Solution

The customers are advised to upgrade to the latest supported version of Acronis Cyber Protect

Vendor References

CVE-2020-10138 - www.kb.cert.org/vuls/id/114757

CVEs related to QID 376220

CVE-2020-10138 |

Software Advisories

Advisory ID	Software	Component	Link
Acronis Cyber Protect			www.acronis.com/en-sg/products/cyber-protect/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].