CVE-2015-7359
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Published at
2017-10-03T01:29Z
2399 days ago
Modified
2021-06-28T18:20Z
1034 days ago
CWE-264
Problem type
Impact
- CVSS v3 vector string
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Severity Score Vector
7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
URL | Type |
---|---|
veracrypt.codeplex.com https://veracrypt.codeplex.com/wikipage?title=Release%20Notes | CONFIRM |
code.google.com https://code.google.com/p/google-security-research/issues/detail?id=537 | MISC |
[oss-security] 20150924 Re: CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege http://www.openwall.com/lists/oss-security/2015/09/24/3 | MLIST |
[oss-security] 20150922 CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege http://www.openwall.com/lists/oss-security/2015/09/22/7 | MLIST |
packetstormsecurity.com http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html | MISC |
GET https://vulnerabilitydata.com/api/details/CVE-2015-7359
{ "id": "CVE-2015-7359", "published_date": "2017-10-03T01:29Z", "last_modified_date": "2021-06-28T18:20Z", "assigner": "cve@mitre.org", "description": "The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.", "references": [ { "url": "https://veracrypt.codeplex.com/wikipage?title=Release%20Notes", "name": "https://veracrypt.codeplex.com/wikipage?title=Release%20Notes", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://code.google.com/p/google-security-research/issues/detail?id=537", "name": "https://code.google.com/p/google-security-research/issues/detail?id=537", "refsource": "MISC", "tags": [ "Third Party Advisory", "Issue Tracking" ] }, { "url": "http://www.openwall.com/lists/oss-security/2015/09/24/3", "name": "[oss-security] 20150924 Re: CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege", "refsource": "MLIST", "tags": [ "Issue Tracking", "Mailing List", "Third Party Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2015/09/22/7", "name": "[oss-security] 20150922 CVE Request - TrueCrypt 7.1a and VeraCrypt 1.14 Local Elevation of Privilege", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html", "name": "http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.html", "refsource": "MISC", "tags": [ "Third Party Advisory", "VDB Entry" ] } ], "impact": { "baseMetricV3": { "cvssV3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH" }, "exploitabilityScore": 1.8, "impactScore": 5.9 }, "baseMetricV2": { "cvssV2": { "version": "2.0", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector": "LOCAL", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 4.6 }, "severity": "MEDIUM", "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } }, "problem_type": "CWE-264" }