CVE:CVE-2010-3199
CNNVD:CNNVD-201009-101
Tortoise SVN 是Subversion 版本控制系统的一个免费开源客户端，可以超越时间的管理文件和目录。
TortoiseSVN 1.6.10版本Build 19898以及早期版本中存在非信任搜索路径漏洞。本地用户也可能是远程攻击者可以借助与Tortoise生成的文件在相同文件夹下的dwmapi.dll木马执行任意代码和DLL劫持攻击。
solution:Upgrade tigris tortoisesvn to a higher version than 1.6.10,0.1,0.2,0.3,0.4,0.5,0.5.1,0.6,0.6.1,0.7,0.8,0.8.1,0.9.1,0.9.2,0.10.0,0.11.0,0.11.2,0.12,0.12.1,0.14,0.15,0.15.1,0.15.2,0.16,0.17,0.18,0.19,0.20,0.20.1,0.20.2,0.21,0.22,0.23,0.24,0.25,0.26,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.1.0,1.1.0:rc1,1.1.0:rc2,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.1.7,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.3.0,1.3.1,1.3.2,1.3.3,1.3.4,1.3.5,1.4.0,1.4.0:rc1,1.4.1,1.4.2,1.4.3,1.4.4,1.4.5,1.4.6,1.4.7,1.4.8,1.5.0,1.5.0:alpha1,1.5.0:beta1,1.5.0:rc1,1.5.0:rc2,1.5.0:rc3,1.5.1,1.5.2,1.5.3,1.5.4,1.5.5,1.5.6,1.5.7,1.5.8,1.5.9,1.5.10,1.6.0,1.6.3,1.6.4,1.6.5,1.6.6,and avoid the version (,1.6.10],0.1,0.2,0.3,0.4,0.5,0.5.1,0.6,0.6.1,0.7,0.8,0.8.1,0.9.1,0.9.2,0.10.0,0.11.0,0.11.2,0.12,0.12.1,0.14,0.15,0.15.1,0.15.2,0.16,0.17,0.18,0.19,0.20,0.20.1,0.20.2,0.21,0.22,0.23,0.24,0.25,0.26,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.1.0,1.1.0:rc1,1.1.0:rc2,1.1.1,1.1.2,1.1.3,1.1.4,1.1.5,1.1.6,1.1.7,1.2.0,1.2.1,1.2.2,1.2.3,1.2.4,1.2.5,1.2.6,1.3.0,1.3.1,1.3.2,1.3.3,1.3.4,1.3.5,1.4.0,1.4.0:rc1,1.4.1,1.4.2,1.4.3,1.4.4,1.4.5,1.4.6,1.4.7,1.4.8,1.5.0,1.5.0:alpha1,1.5.0:beta1,1.5.0:rc1,1.5.0:rc2,1.5.0:rc3,1.5.1,1.5.2,1.5.3,1.5.4,1.5.5,1.5.6,1.5.7,1.5.8,1.5.9,1.5.10,1.6.0,1.6.3,1.6.4,1.6.5,1.6.6