Executive brief
TrueCrypt and VeraCrypt are popular encryption tools used to protect sensitive data on computers. A vulnerability in their installation software allows an attacker to trick the installer into running malicious code if a user runs the installer from a folder containing specially crafted files (such as a Downloads folder). If exploited, this could allow an attacker to gain full administrative control over the computer, potentially leading to data theft or system compromise.
Technical details
An untrusted search path vulnerability (CWE-426) exists in the Windows installers for TrueCrypt (7.1a, 7.2) and VeraCrypt (prior to 1.17-BETA). The installer executables attempt to load several system DLLs (such as USP10.dll, RichEd20.dll, NTMarta.dll, and SRClient.dll) from the application directory (the directory from which the installer is launched) before searching secure system paths. By placing a malicious DLL with one of these names in the same directory as the installer (e.g., a user's Downloads folder), an attacker can achieve arbitrary code execution. Because the installers require administrative privileges to run, the hijacked DLL is executed with elevated permissions, resulting in a full privilege escalation. VeraCrypt addressed this in version 1.17-BETA; TrueCrypt is no longer maintained and remains vulnerable.
Affected products
- IDRIX TrueCrypt 7.1a, 7.2
- IDRIX VeraCrypt Before 1.17-BETA
Timeline
- 2015-12-23: other: Initial report to vendor
- 2016-01-08: disclosed: Public disclosure via Full Disclosure mailing list
- 2016-01-11: patched: VeraCrypt 1.17-BETA released with fix
- 2017-01-23: advisory: NVD publication date