PT-2006-2193 · Microsoft+1 · Windows+1

Nathaniel Smith · Published 2006-03-12 · Updated 2017-07-20 · CVE-2006-1166

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Monotone versions 0.25 and earlier

Description The issue allows context-dependent attackers to execute arbitrary Lua programs as the user running the software. This occurs when a user creates a file in a directory called "mt" and checks it out on a case-insensitive file system, such as Windows or Mac OS X, causing the file to be placed into the "MT" bookkeeping directory.

Recommendations For Monotone versions 0.25 and earlier, consider avoiding the creation of files in directories named "mt" on case-insensitive file systems until a fix is available. As a temporary workaround, restrict access to the "MT" bookkeeping directory to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1166

Affected Products

Macos X

Windows

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1166 · Security Note
• http://lists.gnu.org/archive/html/monotone-devel/2006-03/msg00062.html · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25294 · Note
• http://securityfocus.com/bid/17139 · Note
• http://vupen.com/english/advisories/2006/0990 · Note
• http://secunia.com/advisories/19260 · Note