CVE-2020-35145 : What You Need to Know

Acronis True Image for Windows prior to 2021 Update 3 had a DLL hijacking vulnerability leading to local privilege escalation.

Understanding CVE-2020-35145

This CVE identifies a security issue in Acronis True Image for Windows that could allow an attacker to escalate privileges locally.

What is CVE-2020-35145?

The vulnerability in Acronis True Image for Windows before 2021 Update 3 enables local privilege escalation through DLL hijacking in multiple components, known as an Untrusted Search Path issue.

The Impact of CVE-2020-35145

The vulnerability could be exploited by a local attacker to gain elevated privileges on the affected system, potentially leading to unauthorized access and control.

Technical Details of CVE-2020-35145

Acronis True Image for Windows prior to 2021 Update 3 is susceptible to a DLL hijacking vulnerability, allowing local privilege escalation.

Vulnerability Description

The issue arises from an Untrusted Search Path problem in multiple components of Acronis True Image for Windows, enabling attackers to load malicious DLL files and execute arbitrary code with elevated privileges.

Affected Systems and Versions

Product: Acronis True Image for Windows
Versions: Prior to 2021 Update 3

Exploitation Mechanism

Attackers can exploit this vulnerability by placing a malicious DLL file in a specific location where the application searches for libraries, leading to the execution of unauthorized code with escalated privileges.

Mitigation and Prevention

To address CVE-2020-35145, users and administrators should take immediate action to mitigate the risk and prevent potential exploitation.

Immediate Steps to Take

Update Acronis True Image for Windows to version 2021 Update 3 or later to eliminate the DLL hijacking vulnerability.
Monitor system logs and behavior for any signs of unauthorized access or privilege escalation.

Long-Term Security Practices

Regularly update software and applications to patch known vulnerabilities and enhance overall security posture.
Implement least privilege access controls to limit the impact of potential privilege escalation attacks.

Patching and Updates

Acronis has released Update 3 for Acronis True Image for Windows to address this vulnerability. Ensure timely installation of updates to protect against known security risks.