PT-2019-18715 · Interpeak+1 · Interpeak Ipcomshell+1

Ali Abbasi + 1 · Published 2019-03-26 · Updated 2023-09-20 · CVE-2019-7711

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Green Hills INTEGRITY RTOS version 5.0.4

Description An issue was discovered in the Interpeak IPCOMShell TELNET server. The undocumented shell command "prompt" sets the shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addresses.

Recommendations For Green Hills INTEGRITY RTOS version 5.0.4, consider disabling the use of the prompt command in the Interpeak IPCOMShell TELNET server as a temporary workaround until a patch is available. Restrict access to the TELNET server to minimize the risk of exploitation.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2019-7711

Affected Products

Green Hills Integrity Rtos

Interpeak Ipcomshell

References · 5

• https://osv.dev/vulnerability/CVE-2019-7711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7711 · Security Note
• https://ghs.com/products/rtos/integrity.html · Vendor Advisory
• https://github.com/bl4ckic3/GHS-Bugs · Note
• https://twitter.com/konopka_tg/status/1704409941912522878 · Twitter Post