CVEvulnerability
CVE-2015-7359
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-10-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Affected configurations
• ciphershed ciphershed (<= 0.7.5.0)
• idrix veracrypt (<= 1.14)
• truecrypt truecrypt 7.0
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2015/09/22/7 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/09/24/3 Issue Tracking, Mailing List, Third Party Advisory
- https://code.google.com/p/google-security-research/issues/detail?id=537 Issue Tracking, Third Party Advisory
- https://veracrypt.codeplex.com/wikipage?title=Release%20Notes Release Notes, Vendor Advisory
- http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2015/09/22/7 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/09/24/3 Issue Tracking, Mailing List, Third Party Advisory
- https://code.google.com/p/google-security-research/issues/detail?id=537 Issue Tracking, Third Party Advisory
- https://veracrypt.codeplex.com/wikipage?title=Release%20Notes Release Notes, Vendor Advisory