Description
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | shadow | 4.x before 4.1.5 |
| Red Hat | sudo | 1.x before 1.7.4 |
References
- http://www.openwall.com/lists/oss-security/2012/11/06/8Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/05/20/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/28/10Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/29/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/20/9Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/21/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/12/15/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/02/25/6Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/security/cve/cve-2005-4890Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890Issue Tracking, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2005-4890Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/11/06/8Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/05/20/3Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/28/10Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/11/29/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/20/9Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/10/21/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/12/15/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/02/25/6Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/security/cve/cve-2005-4890Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890Issue Tracking, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2005-4890Third Party Advisory
Timeline
- Published
- Nov 4, 2019
- Last modified
- Jun 16, 2026
- NVD status
- Modified