Adr

The issue concerns an OpenSSL component in Acronis True Image 2021, where the OPENSSLDIR variable is specified as a subdirectory within C:jenkins agent. This component is used by a privileged service within Acronis True Image. An unprivileged Windows user can create subdirectories off the system root, potentially allowing the creation of a specially-crafted openssl.cnf file. This could lead to arbitrary code execution with SYSTEM privileges.

The issue arises from improper ACL settings of the C:ProgramDataAcronis directory by Acronis True Image 2021. This allows an unprivileged user to execute arbitrary code with SYSTEM privileges by placing a DLL in specific paths within C:ProgramDataAcronis.

The issue concerns an OpenSSL component in Acronis Cyber Backup and Cyber Protect that specifies an OPENSSLDIR variable as a subdirectory within C:jenkins agent. This component is used by a privileged service in these products. Unprivileged Windows users can create subdirectories off of the system root, allowing a user to create a path to a specially-crafted openssl.cnf file. This can lead to arbitrary code execution with SYSTEM privileges.

The issue allows local users to enable debugging and obtain sensitive information due to a debug file in sysfs being created with world-readable and world-writable permissions.