PT-2019-18716 · Interpeak+1 · Ipcomshell+1

Ali Abbasi + 1 · Publicado 2019-03-26 · Atualizado 2023-09-20 · CVE-2019-7712

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Green Hills INTEGRITY RTOS version 5.0.4

Description An issue in the Interpeak IPCOMShell TELNET server allows an attacker to forge a path containing format string modifiers when using the pwd command. This results in an information leak of memory addresses due to the lack of proper checks on the current working directory path used as an argument to printf().

Recommendations For Green Hills INTEGRITY RTOS version 5.0.4, consider restricting access to the pwd command in the Interpeak IPCOMShell TELNET server until a proper fix is applied to prevent the evaluation of custom format strings. As a temporary workaround, avoid using the pwd command with untrusted input to minimize the risk of information leakage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2019-7712

Produtos afetados

Integrity Rtos

Ipcomshell

Referências · 5

• https://github.com/bl4ckic3/GHS-Bugs · Nota
• https://osv.dev/vulnerability/CVE-2019-7712 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7712 · Nota de Segurança
• https://ghs.com/products/rtos/integrity.html · Aviso do Fabricante
• https://twitter.com/konopka_tg/status/1704409941912522878 · Publicação no Twitter