CWE Code: 426
Vulnerability Type: privilege_escalation
CVSS Score: 4.4
CWE Name:  Untrusted Search Path
Summary: untrusted search path vulnerability in the installer for truecrypt 7.2 and 7.1a, veracrypt before 1.17-beta, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct dll hijacking attacks via a trojan horse dll in the "application directory", as demonstrated with the usp10.dll, riched20.dll, ntmarta.dll and srclient.dll dlls.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2017-01-23
Last Modified Date: 2017-01-27