PT-2006-2193 · Microsoft+1 · Windows+1

Nathaniel Smith · Publicado 2006-03-12 · Atualizado 2017-07-20 · CVE-2006-1166

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Monotone versions 0.25 and earlier

Description The issue allows context-dependent attackers to execute arbitrary Lua programs as the user running the software. This occurs when a user creates a file in a directory called "mt" and checks it out on a case-insensitive file system, such as Windows or Mac OS X, causing the file to be placed into the "MT" bookkeeping directory.

Recommendations For Monotone versions 0.25 and earlier, consider avoiding the creation of files in directories named "mt" on case-insensitive file systems until a fix is available. As a temporary workaround, restrict access to the "MT" bookkeeping directory to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-1166

Produtos afetados

Macos X

Windows

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/25294 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1166 · Nota de Segurança
• http://lists.gnu.org/archive/html/monotone-devel/2006-03/msg00062.html · Correção
• http://securityfocus.com/bid/17139 · Nota
• http://vupen.com/english/advisories/2006/0990 · Nota
• http://secunia.com/advisories/19260 · Nota