PT-2019-11513

Name of the Vulnerable Software and Affected Versions: Veracrypt versions prior to 1.23-Hotfix-1 Truecrypt all versions Description: The issue is related to a buffer overflow in the Veracrypt NT Driver veracrypt.sys component, which can lead to minor information disclosure of the kernel stack. Th...

StrongPity APT Changes Tactics to Stay Stealthy

The APT group behind the sophisticated malware known as StrongPity a.k.a. Promethium has changed its tactics, after various research groups analyzed the malware and exposed its methods of deployment. The efforts have allowed the group to return to hidden status, even after being labeled a known...

TrueCrypt Security Bypass Vulnerability

TrueCrypt is an open source virtual encryption disk encryption software that creates virtual disks on your hard drive without generating any files. A security vulnerability exists in the 'ProcessVolumeDeviceControlIrp' function of the Ntdriver.c file in TrueCrypt version 7.1a. A local attacker ca...

TrueCrypt Integer Overflow Vulnerability

TrueCrypt is an open source virtual encryption disk encryption software that creates virtual disks on your hard drive without generating any files. An integer overflow vulnerability exists in TrueCrypt version 7.1a. A local attacker can exploit this vulnerability to obtain sensitive information o...

Integer overflow

Multiple integer overflows in TrueCrypt 7.1a allow local users to 1 obtain sensitive information via vectors involving a crafted item-OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or 2 cause a denial of service memory consumption via vectors involving large...

Design/Logic Flaw

The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a 1 TCIOCTLOPENTEST or 2 TCIOCTLGETSYSTEMDRIVECONFIG IOCTL call...

CVE-2014-2884

The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a 1 TCIOCTLOPENTEST or 2 TCIOCTLGETSYSTEMDRIVECONFIG IOCTL call...

CVE-2014-2885

Multiple integer overflows in TrueCrypt 7.1a allow local users to 1 obtain sensitive information via vectors involving a crafted item-OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or 2 cause a denial of service memory consumption via vectors involving large...

CVE-2014-2884

CVE-2014-2884 concerns TrueCrypt 7.1a. The vulnerability is in the Ntdriver.c function ProcessVolumeDeviceControlIrp, where local users can bypass access restrictions and obtain sensitive information about arbitrary files through two IOCTL calls: TC_IOCTL_OPEN_TEST and TC_IOCTL_GET_SYSTEM_DRIVE_C...

CVE-2014-2884

The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a 1 TCIOCTLOPENTEST or 2 TCIOCTLGETSYSTEMDRIVECONFIG IOCTL call...

CVE-2014-2885

Multiple integer overflows in TrueCrypt 7.1a allow local users to 1 obtain sensitive information via vectors involving a crafted item-OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or 2 cause a denial of service memory consumption via vectors involving large...

CVE-2014-2885

Concrete details from connected documents show that CVE-2014-2885 affects TrueCrypt 7.1a via two integer-overflow vectors: (1) OriginalLength handling in EncryptedIoQueue.c:MainThreadProc, enabling local information disclosure; (2) large StartingOffset/Length handling in Ntdriver.c:ProcessVolumeD...

PT-2018-4207

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.1a Description The issue allows local users to bypass access restrictions and obtain sensitive information about arbitrary files. This is achieved through specific IOCTL calls, including TC IOCTL OPEN TEST or TC IOCTL GET...

PT-2018-4208

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.1a Description The issue allows local users to obtain sensitive information or cause a denial of service. This is achieved through multiple integer overflows, specifically via vectors involving a crafted item-OriginalLength...

CVE-2014-2884: Exposure of Sensitive Information to an Unauthorized Actor

The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information about arbitrary files via a 1 TCIOCTLOPENTEST or 2 TCIOCTLGETSYSTEMDRIVECONFIG IOCTL call...

CVE-2014-2885: Integer Overflow or Wraparound

Multiple integer overflows in TrueCrypt 7.1a allow local users to 1 obtain sensitive information via vectors involving a crafted item-OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or 2 cause a denial of service memory consumption via vectors involving large...

Linux Memory Cryptographic Keys Extractor: CryKeX

Some work has been already published regarding the subject of cryptograhic keys security within DRAM. Basically, we need to find something that looks like a key entropic and specific length and then confirm its nature by analyzing the memory structure around it C data types. The idea is to dump...

Parrot Security 3.9 - Security GNU/Linux Distribution Designed with Cloud Pentesting and IoT Security in Mind

Security GNU/Linux distribution designed with cloud pentesting and IoT security in mind. It includes a full portable laboratory for security and digital forensics experts, but it also includes all you need to develop your own softwares or protect your privacy with anonymity and crypto tools...

Code injection

The 1 IsVolumeAccessibleByCurrentUser and 2 MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level an...

CVE-2015-7358

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges...