----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
Acronis True Image Echo Server FTP AES Encryption Security Bypass

SECUNIA ADVISORY ID:
SA30856

VERIFY ADVISORY:
http://secunia.com/advisories/30856/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Acronis True Image Echo Enterprise Server 9.x
http://secunia.com/product/17912/

DESCRIPTION:
Travis C Johnson has discovered a security issue in Acronis True
Image Echo Server, which can be exploited by malicious people to
disclose sensitive information.

The security issue is caused due to the application not correctly
encrypting backups when the backup destination is an FTP server,
which can be exploited to disclose sensitive information by e.g.
intercepting the transfer.

The security issue is confirmed in Acronis True Image Echo Server
build 8072 for Linux. Other versions may also be affected.

SOLUTION:
Do not rely on the encryption when backing up onto FTP servers.

Create local backups and transfer them manually.

PROVIDED AND/OR DISCOVERED BY:
Travis C Johnson

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------