Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge, which is not the default.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tortoisesvn | Tigris | * | 1.6.10 (including) |
| Tortoisesvn | Tigris | 0.1 (including) | 0.1 (including) |
| Tortoisesvn | Tigris | 0.2 (including) | 0.2 (including) |
| Tortoisesvn | Tigris | 0.3 (including) | 0.3 (including) |
| Tortoisesvn | Tigris | 0.4 (including) | 0.4 (including) |
| Tortoisesvn | Tigris | 0.5 (including) | 0.5 (including) |
| Tortoisesvn | Tigris | 0.5.1 (including) | 0.5.1 (including) |
| Tortoisesvn | Tigris | 0.6 (including) | 0.6 (including) |
| Tortoisesvn | Tigris | 0.6.1 (including) | 0.6.1 (including) |
| Tortoisesvn | Tigris | 0.7 (including) | 0.7 (including) |
| Tortoisesvn | Tigris | 0.8 (including) | 0.8 (including) |
| Tortoisesvn | Tigris | 0.8.1 (including) | 0.8.1 (including) |
| Tortoisesvn | Tigris | 0.9.1 (including) | 0.9.1 (including) |
| Tortoisesvn | Tigris | 0.9.2 (including) | 0.9.2 (including) |
| Tortoisesvn | Tigris | 0.10.0 (including) | 0.10.0 (including) |
| Tortoisesvn | Tigris | 0.11.0 (including) | 0.11.0 (including) |
| Tortoisesvn | Tigris | 0.11.2 (including) | 0.11.2 (including) |
| Tortoisesvn | Tigris | 0.12 (including) | 0.12 (including) |
| Tortoisesvn | Tigris | 0.12.1 (including) | 0.12.1 (including) |
| Tortoisesvn | Tigris | 0.14 (including) | 0.14 (including) |
| Tortoisesvn | Tigris | 0.15 (including) | 0.15 (including) |
| Tortoisesvn | Tigris | 0.15.1 (including) | 0.15.1 (including) |
| Tortoisesvn | Tigris | 0.15.2 (including) | 0.15.2 (including) |
| Tortoisesvn | Tigris | 0.16 (including) | 0.16 (including) |
| Tortoisesvn | Tigris | 0.17 (including) | 0.17 (including) |
| Tortoisesvn | Tigris | 0.18 (including) | 0.18 (including) |
| Tortoisesvn | Tigris | 0.19 (including) | 0.19 (including) |
| Tortoisesvn | Tigris | 0.20 (including) | 0.20 (including) |
| Tortoisesvn | Tigris | 0.20.1 (including) | 0.20.1 (including) |
| Tortoisesvn | Tigris | 0.20.2 (including) | 0.20.2 (including) |
| Tortoisesvn | Tigris | 0.21 (including) | 0.21 (including) |
| Tortoisesvn | Tigris | 0.22 (including) | 0.22 (including) |
| Tortoisesvn | Tigris | 0.23 (including) | 0.23 (including) |
| Tortoisesvn | Tigris | 0.24 (including) | 0.24 (including) |
| Tortoisesvn | Tigris | 0.25 (including) | 0.25 (including) |
| Tortoisesvn | Tigris | 0.26 (including) | 0.26 (including) |
| Tortoisesvn | Tigris | 1.0 (including) | 1.0 (including) |
| Tortoisesvn | Tigris | 1.0.1 (including) | 1.0.1 (including) |
| Tortoisesvn | Tigris | 1.0.2 (including) | 1.0.2 (including) |
| Tortoisesvn | Tigris | 1.0.3 (including) | 1.0.3 (including) |
| Tortoisesvn | Tigris | 1.0.4 (including) | 1.0.4 (including) |
| Tortoisesvn | Tigris | 1.0.5 (including) | 1.0.5 (including) |
| Tortoisesvn | Tigris | 1.0.6 (including) | 1.0.6 (including) |
| Tortoisesvn | Tigris | 1.0.7 (including) | 1.0.7 (including) |
| Tortoisesvn | Tigris | 1.0.8 (including) | 1.0.8 (including) |
| Tortoisesvn | Tigris | 1.1.0 (including) | 1.1.0 (including) |
| Tortoisesvn | Tigris | 1.1.0-rc1 (including) | 1.1.0-rc1 (including) |
| Tortoisesvn | Tigris | 1.1.0-rc2 (including) | 1.1.0-rc2 (including) |
| Tortoisesvn | Tigris | 1.1.1 (including) | 1.1.1 (including) |
| Tortoisesvn | Tigris | 1.1.2 (including) | 1.1.2 (including) |
| Tortoisesvn | Tigris | 1.1.3 (including) | 1.1.3 (including) |
| Tortoisesvn | Tigris | 1.1.4 (including) | 1.1.4 (including) |
| Tortoisesvn | Tigris | 1.1.5 (including) | 1.1.5 (including) |
| Tortoisesvn | Tigris | 1.1.6 (including) | 1.1.6 (including) |
| Tortoisesvn | Tigris | 1.1.7 (including) | 1.1.7 (including) |
| Tortoisesvn | Tigris | 1.2.0 (including) | 1.2.0 (including) |
| Tortoisesvn | Tigris | 1.2.1 (including) | 1.2.1 (including) |
| Tortoisesvn | Tigris | 1.2.2 (including) | 1.2.2 (including) |
| Tortoisesvn | Tigris | 1.2.3 (including) | 1.2.3 (including) |
| Tortoisesvn | Tigris | 1.2.4 (including) | 1.2.4 (including) |
| Tortoisesvn | Tigris | 1.2.5 (including) | 1.2.5 (including) |
| Tortoisesvn | Tigris | 1.2.6 (including) | 1.2.6 (including) |
| Tortoisesvn | Tigris | 1.3.0 (including) | 1.3.0 (including) |
| Tortoisesvn | Tigris | 1.3.1 (including) | 1.3.1 (including) |
| Tortoisesvn | Tigris | 1.3.2 (including) | 1.3.2 (including) |
| Tortoisesvn | Tigris | 1.3.3 (including) | 1.3.3 (including) |
| Tortoisesvn | Tigris | 1.3.4 (including) | 1.3.4 (including) |
| Tortoisesvn | Tigris | 1.3.5 (including) | 1.3.5 (including) |
| Tortoisesvn | Tigris | 1.4.0 (including) | 1.4.0 (including) |
| Tortoisesvn | Tigris | 1.4.0-rc1 (including) | 1.4.0-rc1 (including) |
| Tortoisesvn | Tigris | 1.4.1 (including) | 1.4.1 (including) |
| Tortoisesvn | Tigris | 1.4.2 (including) | 1.4.2 (including) |
| Tortoisesvn | Tigris | 1.4.3 (including) | 1.4.3 (including) |
| Tortoisesvn | Tigris | 1.4.4 (including) | 1.4.4 (including) |
| Tortoisesvn | Tigris | 1.4.5 (including) | 1.4.5 (including) |
| Tortoisesvn | Tigris | 1.4.6 (including) | 1.4.6 (including) |
| Tortoisesvn | Tigris | 1.4.7 (including) | 1.4.7 (including) |
| Tortoisesvn | Tigris | 1.4.8 (including) | 1.4.8 (including) |
| Tortoisesvn | Tigris | 1.5.0 (including) | 1.5.0 (including) |
| Tortoisesvn | Tigris | 1.5.0-alpha1 (including) | 1.5.0-alpha1 (including) |
| Tortoisesvn | Tigris | 1.5.0-beta1 (including) | 1.5.0-beta1 (including) |
| Tortoisesvn | Tigris | 1.5.0-rc1 (including) | 1.5.0-rc1 (including) |
| Tortoisesvn | Tigris | 1.5.0-rc2 (including) | 1.5.0-rc2 (including) |
| Tortoisesvn | Tigris | 1.5.0-rc3 (including) | 1.5.0-rc3 (including) |
| Tortoisesvn | Tigris | 1.5.1 (including) | 1.5.1 (including) |
| Tortoisesvn | Tigris | 1.5.2 (including) | 1.5.2 (including) |
| Tortoisesvn | Tigris | 1.5.3 (including) | 1.5.3 (including) |
| Tortoisesvn | Tigris | 1.5.4 (including) | 1.5.4 (including) |
| Tortoisesvn | Tigris | 1.5.5 (including) | 1.5.5 (including) |
| Tortoisesvn | Tigris | 1.5.6 (including) | 1.5.6 (including) |
| Tortoisesvn | Tigris | 1.5.7 (including) | 1.5.7 (including) |
| Tortoisesvn | Tigris | 1.5.8 (including) | 1.5.8 (including) |
| Tortoisesvn | Tigris | 1.5.9 (including) | 1.5.9 (including) |
| Tortoisesvn | Tigris | 1.5.10 (including) | 1.5.10 (including) |
| Tortoisesvn | Tigris | 1.6.0 (including) | 1.6.0 (including) |
| Tortoisesvn | Tigris | 1.6.3 (including) | 1.6.3 (including) |
| Tortoisesvn | Tigris | 1.6.4 (including) | 1.6.4 (including) |
| Tortoisesvn | Tigris | 1.6.5 (including) | 1.6.5 (including) |
| Tortoisesvn | Tigris | 1.6.6 (including) | 1.6.6 (including) |
References
- http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061\u0026dsMessageId=2653163
- http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061\u0026dsMessageId=2653202\u0026orderBy=createDate\u0026orderType=desc
- http://www.securityfocus.com/archive/1/513442/100/0/threaded
- http://www.securityfocus.com/archive/1/513463/100/0/threaded
- http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061\u0026dsMessageId=2653163
- http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061\u0026dsMessageId=2653202\u0026orderBy=createDate\u0026orderType=desc
- http://www.securityfocus.com/archive/1/513442/100/0/threaded
- http://www.securityfocus.com/archive/1/513463/100/0/threaded