The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt prior to 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
ciphershed ciphershed |
||
truecrypt truecrypt 7.0 |
||
idrix veracrypt |
Elevation-of-privilege vulnerabilities found in popular encryption system
Google Project Zero hacker James Forshaw has found a pair of privilege-elevation holes in the once-popular TrueCrypt encryption package. The bugs have been patched in spinoff app Veracrypt, so if you want to stay secure, you may want to shift over to that package. The flaws are not the fabled backdoors feared lurking in the TrueCrypt code, but can be exploited to compromise the machine, install spyware, record password keystrokes, and so on. TrueCrypt development was axed last year after its mys...
Vulmon