CVE-2005-4890

Dashboard / Vulnerabilities / CVE-2005-4890

CVE-2005-4890

Published: 4 Nov 2019Last Modified: 10 Apr 2026

Summary:

Details: There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

References: http://www.openwall.com/lists/oss-security/2012/11/06/8, http://www.openwall.com/lists/oss-security/2013/05/20/3, http://www.openwall.com/lists/oss-security/2013/11/28/10, http://www.openwall.com/lists/oss-security/2013/11/29/5, http://www.openwall.com/lists/oss-security/2014/10/20/9, http://www.openwall.com/lists/oss-security/2014/10/21/1, http://www.openwall.com/lists/oss-security/2014/12/15/5, http://www.openwall.com/lists/oss-security/2016/02/25/6, https://access.redhat.com/security/cve/cve-2005-4890, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890, https://security-tracker.debian.org/tracker/CVE-2005-4890, http://www.openwall.com/lists/oss-security/2012/11/06/8, http://www.openwall.com/lists/oss-security/2013/05/20/3, http://www.openwall.com/lists/oss-security/2013/11/28/10, http://www.openwall.com/lists/oss-security/2013/11/29/5, http://www.openwall.com/lists/oss-security/2014/10/20/9, http://www.openwall.com/lists/oss-security/2014/10/21/1, http://www.openwall.com/lists/oss-security/2014/12/15/5, http://www.openwall.com/lists/oss-security/2016/02/25/6, http://www.openwall.com/lists/oss-security/2016/02/25/6, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890

Affected packages

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High

CVE-2005-4890 | CVE-DB