CVE-2015-7359

The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2017-10-03

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Ciphershed (Ciphershed)
• Veracrypt (Idrix)
• Truecrypt (Truecrypt)

References

• http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html
• http://www.openwall.com/lists/oss-security/2015/09/22/7
• http://www.openwall.com/lists/oss-security/2015/09/24/3
• https://code.google.com/p/google-security-research/issues/detail?id=537
• https://veracrypt.codeplex.com/wikipage?title=Release%20Notes