[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege
- To: "Michel Arboi" <michel.arboi@xxxxxxxxx>
- Subject: Re: [FD] Executable installers are vulnerable^WEVIL (case 20): TrueCrypt's installers allow arbitrary (remote) code execution and escalation of privilege
- From: "Stefan Kanthak" <stefan.kanthak@xxxxxxxx>
- Date: Tue, 12 Jan 2016 17:32:07 +0100
"Michel Arboi" <michel.arboi@xxxxxxxxx> wrote:
> On 11 January 2016 at 15:37, Stefan Kanthak <stefan.kanthak@xxxxxxxx> wrote:
>> Which but does not mean/imply that everybody abandons TrueCrypt.
>
> The project has been abruptly killed by the developers without any
> clear explanation. There's something fishy and it cannot be trusted
> anymore.
> Spend your time and energy on forks like CipherShed or VeraCrypt!
See <http://seclists.org/oss-sec/2016/q1/58> alias CVE-2016-1281
And see <http://seclists.org/fulldisclosure/2015/Nov/101> again:
| almost all executable installers (and self-extractors as well
| as "portable" applications too) for Windows have a well-known
| (trivial, trivial to detect and trivial to exploit) vulnerability:
>> STOP posting on top, but DON'T stop reading on top, read that
>> page COMPLETELY and notice the download(s) offered at its end!
>
> AFAIK, TrueCrypt 7.2 is only capable of decryption. It is provided so
> that users can migrate their data to another system.
and has a vulnerable installer, like all its predecessors and all
forks of TrueCrypt.
stay tuned
Stefan Kanthak
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/