CVE-2015-7358

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 1.2%

from disclosure to weapon0 days

Published on NVDOct 2

1st PoCOct 5

exploitation probability

1.2%top 35% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38403 cve_referencepacketstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.htmlunverified cve_referencewww.exploit-db.com/exploits/38403/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.html https://code.google.com/p/google-security-research/issues/detail?id=538 https://veracrypt.codeplex.com/wikipage?title=Release%20Notes https://www.exploit-db.com/exploits/38403/http://www.openwall.com/lists/oss-security/2015/09/22/7 http://www.openwall.com/lists/oss-security/2015/09/24/3