CVE-2019-7713

An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. There is a heap-based buffer overflow in the function responsible for printing the shell prompt, when a custom modifier is used to display information such as a process ID, IP address, or current working directory. Modifier expansion triggers this overflow, causing memory corruption or a crash (and also leaks memory address information).

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/bl4ckic3/GHS-Bugs	Exploit Third Party Advisory
https://www.ghs.com/products/rtos/integrity.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:ghs:integrity_rtos:5.0.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-26 01:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-7713

Mitre link : CVE-2019-7713

CVE.ORG link : CVE-2019-7713

JSON object : View

Products Affected

ghs

integrity_rtos

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2019-7713", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-03-26T01:29:00.883", "references": [{"url": "https://github.com/bl4ckic3/GHS-Bugs", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.ghs.com/products/rtos/integrity.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. There is a heap-based buffer overflow in the function responsible for printing the shell prompt, when a custom modifier is used to display information such as a process ID, IP address, or current working directory. Modifier expansion triggers this overflow, causing memory corruption or a crash (and also leaks memory address information)."}, {"lang": "es", "value": "Se ha encontrado un problema en el servidor Interpeak IPCOMShell TELNET en Green Hills INTEGRITY RTOS 5.0.4. Hay un desbordamiento de b\u00fafer basado en memoria din\u00e1mica (heap) en la funci\u00f3n encargada de imprimir el int\u00e9rprete de comandos shell cuando se utiliza un modificador personalizado para mostrar informaci\u00f3n como el ID de un proceso, la direcci\u00f3n IP o el directorio de trabajo actual. La expansi\u00f3n del modificador provoca este desbordamiento, que resulta en una corrupci\u00f3n de memoria y un cierre inesperado, adem\u00e1s de provocar una fuga de informaci\u00f3n de direcciones de memoria."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ghs:integrity_rtos:5.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BF4035E-02BD-499A-AB23-346F1EC3A1AD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}