CVE-2015-7358

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges...

CVE-2015-7359

The 1 IsVolumeAccessibleByCurrentUser and 2 MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level an...

CVE-2015-7358

CVE-2015-7358 affects TrueCrypt 7.0, VeraCrypt (before 1.15), and CipherShed; the IsDriveLetterAvailable check in the Windows driver (Driver/Ntdriver.c) fails to validate drive-letter symbolic links, enabling a local attacker to remap a system drive and gain full privileges via the GLOBAL?? entry...

CVE-2015-7359

CVE-2015-7359 concerns the Windows kernel driver in TrueCrypt 7.0, VeraCrypt (before 1.15), and CipherShed. The flaw: IsVolumeAccessibleByCurrentUser and MountDevice do not validate the impersonation level of tokens, allowing local users to impersonate a user at SecurityIdentify level and access ...

PT-2017-7199

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.0 VeraCrypt versions prior to 1.15 CipherShed affected versions not specified Description The issue arises from the IsDriveLetterAvailable method in Driver/Ntdriver.c, which fails to properly validate drive letter symbolic...

PT-2017-7200

Name of the Vulnerable Software and Affected Versions TrueCrypt version 7.0 VeraCrypt versions prior to 1.15 CipherShed affected versions not specified Description The issue arises from the lack of impersonation level checks in the IsVolumeAccessibleByCurrentUser and MountDevice methods within...

CVE-2016-1281

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

Design/Logic Flaw

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

CVE-2016-1281

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

CVE-2016-1281

The CVE-2016-1281 entry describes an untrusted search path/DLL hijacking vulnerability in installers for TrueCrypt 7.2 and 7.1a , and VeraCrypt before 1.17-BETA (and possibly other products). The issue allows local users to execute arbitrary code with administrator privileges by placing a Trojan ...

CVE-2016-1281: Untrusted Search Path

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

PT-2017-7953

Name of the Vulnerable Software and Affected Versions TrueCrypt versions 7.1a through 7.2 VeraCrypt versions prior to 1.17-BETA Description The issue allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the...

Encryption software VeraCrypt audit reports published, discovered multiple high risk vulnerabilities attached report download-vulnerability warning-the black bar safety net

! In DuckDuckGo and VikingVPN funded by QuarksLab recent open-source encryption software VeraCrypt conducted a security audit. The audit found that the 8 high-risk vulnerabilities, and 1 0 more in the lower level of vulnerability. About VeraCrypt VeraCrypt is a very popular disk encryption softwa...

Critical Vulnerabilities Uncovered in VeraCrypt Audit Patched

An audit of open source file and disk encryption package VeraCrypt turned up a number of critical vulnerabilities that have been patched in the month since the assessment was wrapped up. The audit, which began Aug. 16, was funded by the Open Source Technology Improvement Fund OSTIF and executed b...

VeraCrypt Audit Reveals Critical Security Flaws — Update Now

After TrueCrypt mysteriously discontinued its service, VeraCrypt became the most popular open source disk encryption software used by activists, journalists, as well as privacy conscious people. First of all, there is no such thing as a perfect, bug-free software. Even the most rigorously tested...

Open Source Disk Encryption: VeraCrypt

VeraCrypt is a software for establishing and maintaining an on-the-fly-encrypted volume data storage device. On-the-fly encryption means that data is automatically encrypted right before it is saved and decrypted right after it is loaded, without any user intervention. No data stored on an...

On Shadow Brokers, the VeraCrypt Audit, and Pokemon Ransomware

Mike Mimoso and Chris Brook discuss the news of the week, including the Shadow Brokers debacle, the VeraCrypt audit, Pokemon ransomware, and a browser address bar vulnerability. Download: ThreatpostNewsWrapAugust192016.mp3 Music by Chris Gonsalves...

VeraCrypt Audit Under Way; Email Mystery Cleared Up

Update To say the VeraCrypt audit, which begins today, got off to an inauspicious start would be an understatement. On Sunday, two weeks after the announcement that the open source file and disk encryption software would be formally scrutinized for security vulnerabilities, executives at one of t...

Someone is Spying on Researchers Behind VeraCrypt Security Audit

After TrueCrypt mysteriously discontinued itself, VeraCrypt became the most popular open source disk encryption software used by activists, journalists, and privacy conscious people. Due to the huge popularity of VeraCrypt, security researchers from the OSTIF The Open Source Technology Improvemen...

TrueCrypt and VeraCrypt DLL File Loading Arbitrary Code Execution Vulnerability

TrueCrypt and VeraCrypt are both free, open source disk encryption software. TrueCrypt and VeraCrypt load DLLs contain security vulnerabilities that allow attackers to exploit the vulnerabilities to build malicious files that can be parsed by the user and can execute arbitrary code...