PT-2017-7199 · Ciphershed Team+3 · Ciphershed+3

James Forshaw · Publicado 2017-10-02 · Atualizado 2021-06-28 · CVE-2015-7358

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.0 VeraCrypt versions prior to 1.15 CipherShed (affected versions not specified)

Description The issue arises from the IsDriveLetterAvailable method in Driver/Ntdriver.c, which fails to properly validate drive letter symbolic links when running on Windows. This allows local users to mount an encrypted volume over an existing drive letter, potentially gaining privileges via an entry in the /GLOBAL?? directory.

Recommendations For TrueCrypt version 7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For VeraCrypt versions prior to 1.15: Update to version 1.15 or later to resolve the issue. For CipherShed: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-7358

Produtos afetados

Ciphershed

Truecrypt

Veracrypt

Windows

Referências · 8

• 🔥 https://exploit-db.com/exploits/38403 · Exploit
• http://openwall.com/lists/oss-security/2015/09/22/7 · Nota
• http://openwall.com/lists/oss-security/2015/09/24/3 · Nota
• https://t.me/cvenotify/16792 · Publicação no Telegram
• http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.html · Nota
• https://code.google.com/p/google-security-research/issues/detail?id=538 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7358 · Nota de Segurança
• https://veracrypt.codeplex.com/wikipage?title=Release%20Notes · Aviso do Fabricante