PT-2019-11513 · Truecrypt Foundation+1 · Truecrypt+1

Tim Harrison · Publicado 2019-07-23 · Atualizado 2021-02-19 · CVE-2019-1010208

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Veracrypt versions prior to 1.23-Hotfix-1 Truecrypt all versions

Description: The issue is related to a buffer overflow in the Veracrypt NT Driver (veracrypt.sys) component, which can lead to minor information disclosure of the kernel stack. This can be exploited through locally executed code by sending an IOCTL request to the driver.

Recommendations: For Veracrypt versions prior to 1.23-Hotfix-1, update to version 1.23-Hotfix-1 to resolve the issue. For Truecrypt, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Veracrypt NT Driver (veracrypt.sys) to minimize the risk of exploitation.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2019-1010208

MGASA-2021-0088

Produtos afetados

Truecrypt

Veracrypt

Referências · 6

• https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e · Correção
• https://osv.dev/vulnerability/CVE-2019-1010208 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=28078 · Nota
• https://osv.dev/vulnerability/MGASA-2021-0088 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2021-0088.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010208 · Nota de Segurança