How to remediate – Acronis Agent Detection (UDP)

1. Introduction

The Acronis Agent Detection (UDP) vulnerability identifies a backup service listening on remote hosts. This indicates an Acronis Agent, part of Acronis TrueImage, is running and potentially accessible from the network. While not directly exploitable as-is, it presents an increased attack surface. Systems running Acronis TrueImage or agents are usually affected. Likely impact: low confidentiality, integrity, and availability if combined with other vulnerabilities.

2. Technical Explanation

The vulnerability stems from the Acronis Agent listening on a UDP port for management communication. This allows attackers to identify systems running the agent. While not an immediate exploit path, it can be used in reconnaissance and potentially lead to further attacks if combined with other vulnerabilities or misconfigurations. There is no known CVE associated with this specific detection. An attacker could scan a network for open ports and identify Acronis Agents, then attempt to exploit known vulnerabilities within the agent software itself or related services. Affected platforms are Windows systems running Acronis TrueImage agents.

• Root cause: The Acronis Agent service listens on UDP port 139 for communication.
• Exploit mechanism: An attacker scans a network for open UDP port 139, identifying hosts with the Acronis Agent running. This is typically used as part of broader reconnaissance to identify potential targets.
• Scope: Windows systems running Acronis TrueImage agents are affected.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking for the listening service or using network scanning tools.

• Quick checks: Use netstat -an | findstr ":139" in Command Prompt to check for a process listening on UDP port 139.
• Scanning: Nessus plugin ID 14268 can identify Acronis Agent services. This is an example only, and results may vary.
• Logs and evidence: Check Windows Event Logs for events related to the Acronis Agent service startup or communication errors.

netstat -an | findstr ":139"

4. Solution / Remediation Steps

Limit incoming traffic to this port if desired.

4.1 Preparation

• Services: No services need to be stopped for this remediation.
• Roll back plan: Re-enable incoming traffic on port 139 if needed. Change window is not required, but consider impact during peak hours.

4.2 Implementation

1. Step 1: Use Windows Firewall to block inbound UDP traffic on port 139. Open the “Windows Defender Firewall with Advanced Security” application.
2. Step 2: Create a new Inbound Rule. Select “Port”.
3. Step 3: Specify UDP and port 139. Block the connection.
4. Step 4: Apply the rule to all profiles (Domain, Private, Public). Give the rule a descriptive name like “Block Acronis Agent UDP”.

4.3 Config or Code Example

Before

(No specific configuration exists, port is open by default)

After

(Windows Firewall rule blocking inbound UDP traffic on port 139)

4.4 Security Practices Relevant to This Vulnerability

Least privilege and network segmentation can reduce the impact of this issue.

• Practice 1: Least privilege – only allow necessary services to listen on open ports.
• Practice 2: Network segmentation – isolate critical systems from untrusted networks.

4.5 Automation (Optional)

# PowerShell example to block port 139 using New-NetFirewallRule
New-NetFirewallRule -DisplayName "Block Acronis Agent UDP" -Direction Inbound -Protocol UDP -LocalPort 139 -Action Block -Profile Domain,Private,Public

5. Verification / Validation

Confirm the fix by checking if port 139 is blocked and verifying that the agent service still functions as expected.

• Post-fix check: Run netstat -an | findstr ":139" again; no listening process should be shown on UDP port 139.
• Re-test: Re-run the initial scan (Nessus plugin ID 14268) to confirm it no longer detects the open port.
• Monitoring: Monitor Windows Event Logs for any errors related to the Acronis Agent service.

netstat -an | findstr ":139"

6. Preventive Measures and Monitoring

Update security baselines and implement regular patch management.

• Baselines: Update your Windows Firewall baseline to include a rule blocking inbound UDP traffic on port 139.
• Asset and patch process: Implement a regular patch management cycle for Acronis TrueImage agents.

7. Risks, Side Effects, and Roll Back

Blocking port 139 may interfere with remote management of the agent if other services rely on it.

• Risk or side effect 1: Blocking port 139 could disrupt remote access to the Acronis Agent.
• Roll back: Remove the “Block Acronis Agent UDP” firewall rule to re-enable inbound traffic on port 139.

8. References and Resources

• Vendor advisory or bulletin: http://www.acronis.com/enterprise/products/ATIES/windows-agent.html