TrueCrypt <= 4.3 Local Privilege Escalation Exploit (CVE-2007-1738)

🗓️ 10 Apr 2007 00:00:00Reported by RootType

TrueCrypt 4.3 local privilege escalation exploit (CVE-2007-1738). Setuid truecrypt privilege escalation allowing denial of service or gaining privileges by mounting crafted TrueCrypt volume. Proof of concept exploit taking advantage of NPTL thread local storage dynamic linking model. Other possible attack vectors include /etc/cron, xinetd, /etc/logrotate.d, and more

Reporter	Title	Published	Views	Family All 14
0day.today	TrueCrypt <= 4.3 Local Privilege Escalation Exploit (CVE-2007-1738)	4 Apr 200700:00	–	zdt
CVE	CVE-2007-1589	21 Mar 200723:00	–	cve
CVE	CVE-2007-1738	28 Mar 200722:00	–	cve
Cvelist	CVE-2007-1589	21 Mar 200723:00	–	cvelist
Cvelist	CVE-2007-1738	28 Mar 200722:00	–	cvelist
EUVD	EUVD-2007-1583	7 Oct 202500:30	–	euvd
EUVD	EUVD-2007-1732	7 Oct 202500:30	–	euvd
exploitpack	TrueCrypt 4.3 - setuid Local Privilege Escalation	4 Apr 200700:00	–	exploitpack
NVD	CVE-2007-1589	21 Mar 200723:19	–	nvd
NVD	CVE-2007-1738	28 Mar 200722:19	–	nvd


                                                #&nbsp;$Id:&nbsp;raptor_truecrypt,v&nbsp;1.1.1.1&nbsp;2007/04/04&nbsp;11:31:56&nbsp;raptor&nbsp;Exp&nbsp;$
#
#&nbsp;raptor_truecrypt&nbsp;-&nbsp;setuid&nbsp;truecrypt&nbsp;privilege&nbsp;escalation
#&nbsp;Copyright&nbsp;(c)&nbsp;2007&nbsp;Marco&nbsp;Ivaldi&nbsp;&lt;[email protected]&gt;
#
#&nbsp;TrueCrypt&nbsp;4.3,&nbsp;when&nbsp;installed&nbsp;setuid&nbsp;root,&nbsp;allows&nbsp;local&nbsp;users&nbsp;to&nbsp;cause&nbsp;a&nbsp;
#&nbsp;denial&nbsp;of&nbsp;service&nbsp;(filesystem&nbsp;unavailability)&nbsp;or&nbsp;gain&nbsp;privileges&nbsp;by&nbsp;mounting&nbsp;
#&nbsp;a&nbsp;crafted&nbsp;TrueCrypt&nbsp;volume,&nbsp;as&nbsp;demonstrated&nbsp;using&nbsp;(1)&nbsp;/usr/bin&nbsp;or&nbsp;(2)&nbsp;another
#&nbsp;user's&nbsp;home&nbsp;directory,&nbsp;a&nbsp;different&nbsp;issue&nbsp;than&nbsp;CVE-2007-1589&nbsp;(CVE-2007-1738).
#
#&nbsp;WARNING:&nbsp;THIS&nbsp;IS&nbsp;A&nbsp;PROOF&nbsp;OF&nbsp;CONCEPT&nbsp;EXPLOIT&nbsp;TAKING&nbsp;ADVANTAGE&nbsp;OF&nbsp;NPTL&nbsp;THREAD
#&nbsp;LOCAL&nbsp;STORAGE&nbsp;DYNAMIC&nbsp;LINKING&nbsp;MODEL,&nbsp;DO&nbsp;NOT&nbsp;USE&nbsp;IT&nbsp;IF&nbsp;YOU&nbsp;DON'T&nbsp;KNOW&nbsp;HOW&nbsp;IT
#&nbsp;WORKS!&nbsp;YEAH,&nbsp;IT&nbsp;*DOES*&nbsp;REQUIRE&nbsp;SOME&nbsp;TWEAKINGS&nbsp;TO&nbsp;EXPLOIT&nbsp;NON-TLS&nbsp;PLATFORMS!
#
#&nbsp;Other&nbsp;possible&nbsp;attack&nbsp;vectors:&nbsp;/etc/cron.{d,hourly,daily,weekly,monthly},&nbsp;at&nbsp;
#&nbsp;(/var/spool/atjobs/),&nbsp;xinetd&nbsp;(/etc/xinetd.d),&nbsp;/etc/logrotate.d,&nbsp;and&nbsp;more...

http://www.0xdeadbeef.info/exploits/raptor_truecrypt.tgz
http://www.milw0rm.com/sploits/04042007-raptor_truecrypt.tgz

10 Apr 2007 00:00Current

6.5Medium risk

Vulners AI Score6.5

EPSS0.00156

TrueCrypt &lt;= 4.3 Local Privilege Escalation Exploit (CVE-2007-1738)

TrueCrypt <= 4.3 Local Privilege Escalation Exploit (CVE-2007-1738)