CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.2
CWE Name:  Permissions Privileges and Access Controls
Summary: the isdriveletteravailable method in driver/ntdriver.c in truecrypt 7.0, veracrypt before 1.15, and ciphershed, when running on windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /global?? directory.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-10-03
Last Modified Date: 2017-10-17