oss-sec mailing list archives
CVE-2016-1281: TrueCrypt and VeraCrypt Windows installers allow arbitrary code execution with elevation of privilege
From: VeraCrypt Team <veracrypt () idrix fr>
Date: Mon, 11 Jan 2016 00:43:00 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, The Windows installers of TrueCrypt 7.1a (latest version) and its fork VeraCrypt 1.16 (latest version) are vulnerable to Dll Hijacking that allows arbitrary code execution with elevation of privilege. This vulnerability affects on all version of Windows. More information can be found at: http://seclists.org/fulldisclosure/2016/Jan/22 The patches applied to fix this issue in VeraCrypt are: - https://github.com/veracrypt/VeraCrypt/commit/5872be28a243acb3b5aafdf13248e07d30471893 - https://github.com/veracrypt/VeraCrypt/commit/7a15ff2083d75cdfe343de154715442dce635492 The fix has been included in VeraCrypt 1.17-BETA (Build 15) which is available at: https://veracrypt.codeplex.com/releases/view/619351. Many thanks to Stefan Kanthak (http://home.arcor.de/skanthak) for reporting this issue and for his help in verifying the correctness of the fix. Regards, - -- Mounir IDRASSI https://veracrypt.codeplex.comhttps://www.idrix.fr -----BEGIN PGP SIGNATURE----- Version: APG v1.1.1 iQJBBAEBCgArBQJWkvqUJBxWZXJhQ3J5cHQgVGVhbSA8dmVyYWNyeXB0QGlkcml4 LmZyPgAKCRDrVZx8VN3Tk6yKEAC55GJk9X0hanR7sOwUjLBDoH7tbeGrQhSq0FkQ qV9Tws0EnXSvRhCbMCgZcbm/T6x6fcRBOVuUUv5QGWZoRX0QISRnNASbYA0LM82v QJ6g11uW0BEBdQ/VK7Gb5l8g3c6cDGT4zvJc8dduqK42Ri+Thl+uB3i8mdDDfNS7 BJQdvULXZsurqDFZthsQIuHPvyH5EfJkFAJ4Cqc6f/uWDQWd1o/KcMK4dd2VAc0S cEEGMhcYUJDFepPcYzRG9RW74bS7zH7bPcA3WnBEEy2cVuLg5BAolLBFL8hSdfDz jYsj8B/DHdUP66I0zoMh1Cw9kugYSr1W2CUNKA2YeKb8D41HfdjzpRw9WIf5o/Fb ldnvpojwj5g5e4Pn46D+YUlrWmUWqcWaYR962e+cN8pS+jflBBo8VzYKjKn8UaHK 8tq+86t6y6tqYSHLiD1SgCyjf+Bs9Vr4koL4bvT+/AMGAvKrj0bv/lfQHGhPrerX SigYMWoSJ/v1LmKZWBM6YWfOITEPCSSn/Uycr1tAwNsYhcirDgOi/SLel4l0le/2 OmOkmxOQHzK7usROHaDL5s6P/odtlkjyMTnr4SQ6PRRalLL8AcabOaZIm+5CVkA9 FrV6/gsYpIW8Oj1lAmDt6Z3OQFyaKxc20YJ+DaK+yOPEomkLzRArMQd0GWvoKhEL +wSLGw== =uVgl -----END PGP SIGNATURE-----
Current thread:
- CVE-2016-1281: TrueCrypt and VeraCrypt Windows installers allow arbitrary code execution with elevation of privilegeVeraCrypt Team (Jan 10)
