CVE-2015-7359 The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level...
HighCVSS 7.8
EPSS 0.58%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ciphershed | <= 0.7.5.0 | No fix listed |
| IDRIX VeraCrypt | <= 1.14 | No fix listed |
| truecrypt | = 7.0 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- [oss-security] 20150922 CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege mailing-list third-party-advisory
- [oss-security] 20150924 Re: CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege issue-tracking mailing-list third-party-advisory
- code.google.com issue-tracking third-party-advisory
- veracrypt.codeplex.com release-notes vendor-advisory