PT-2017-7200 · Ciphershed Team+3 · Ciphershed+3

James Forshaw · Publicado 2017-10-02 · Atualizado 2021-06-28 · CVE-2015-7359

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.0 VeraCrypt versions prior to 1.15 CipherShed (affected versions not specified)

Description The issue arises from the lack of impersonation level checks in the IsVolumeAccessibleByCurrentUser and MountDevice methods within Ntdriver.c. This allows local users to impersonate a user at the SecurityIdentify level, thereby gaining unauthorized access to other users' mounted encrypted volumes when running on Windows.

Recommendations For TrueCrypt version 7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For VeraCrypt versions prior to 1.15: Update to version 1.15 or later. For CipherShed: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-7359

Produtos afetados

Ciphershed

Truecrypt

Veracrypt

Windows

Referências · 6

• http://openwall.com/lists/oss-security/2015/09/22/7 · Nota
• http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7359 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/09/24/3 · Nota
• https://code.google.com/p/google-security-research/issues/detail?id=537 · Nota
• https://veracrypt.codeplex.com/wikipage?title=Release%20Notes · Aviso do Fabricante