[原文]Untrusted search path vulnerability in Truecrypt 4.1, when running suid root on Linux, allows local users to execute arbitrary commands and gain privileges via a modified PATH environment variable that references a malicious mount command.
TrueCrypt External Command Path Subversion Local Privilege Escalation
Local Access Required
Loss of Integrity
TrueCrypt contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is caused by the unsafe use of the 'execvp()' function to execute external commands without sanitising the user's current PATH settings. This flaw may lead to a loss of integrity.
Upgrade to version 4.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.