Is CVE-2016-1281 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1281 being exploited in the wild.

How severe is CVE-2016-1281?

High severity, with a CVSS score of 7.8, published 23 January 2017.

Which products and versions are affected?

Idrix Truecrypt 7.1a, 7.2; Idrix Veracrypt Before 1.17-BETA.

Is there a fix for CVE-2016-1281?

A patch was published on 2016-01-11: VeraCrypt 1.17-BETA released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-1281 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2016-1281?

Check whether you run Idrix Truecrypt or Idrix Veracrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1281: TrueCrypt and VeraCrypt DLL hijacking in Windows installers

CVE-2016-1281 · Severity: high · CVSS 7.8 · Published 2017-01-23

TrueCrypt and VeraCrypt are popular encryption tools used to protect sensitive data on computers. A vulnerability in their installation software allows an attacker to trick the installer into running malicious code if a user runs the installer from a folder containing specially crafted files (such as a Downloads folder). If exploited, this could allow an attacker to gain full administrative control over the computer, potentially leading to data theft or system compromise.

Technologies: Idrix Veracrypt. Vendors: Idrix.

Quick answers

Is CVE-2016-1281 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1281 being exploited in the wild.
How severe is CVE-2016-1281?: High severity, with a CVSS score of 7.8, published 23 January 2017.
Which products and versions are affected?: Idrix Truecrypt 7.1a, 7.2; Idrix Veracrypt Before 1.17-BETA.
Is there a fix for CVE-2016-1281?: A patch was published on 2016-01-11: VeraCrypt 1.17-BETA released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-1281 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2016-1281?: Check whether you run Idrix Truecrypt or Idrix Veracrypt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An untrusted search path vulnerability (CWE-426) exists in the Windows installers for TrueCrypt (7.1a, 7.2) and VeraCrypt (prior to 1.17-BETA). The installer executables attempt to load several system DLLs (such as USP10.dll, RichEd20.dll, NTMarta.dll, and SRClient.dll) from the application directory (the directory from which the installer is launched) before searching secure system paths. By placing a malicious DLL with one of these names in the same directory as the installer (e.g., a user's Downloads folder), an attacker can achieve arbitrary code execution. Because the installers require administrative privileges to run, the hijacked DLL is executed with elevated permissions, resulting in a full privilege escalation. VeraCrypt addressed this in version 1.17-BETA; TrueCrypt is no longer maintained and remains vulnerable.

Affected products

IDRIX TrueCrypt 7.1a, 7.2
IDRIX VeraCrypt Before 1.17-BETA

Timeline

2015-12-23: other: Initial report to vendor
2016-01-08: disclosed: Public disclosure via Full Disclosure mailing list
2016-01-11: patched: VeraCrypt 1.17-BETA released with fix
2017-01-23: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.