CVE-2005-4890 There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to p...
HighCVSS 7.8
EPSS 0.63%
- Published
- Updated
- Exploit status
- No public exploit known
Description
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/shadow(Debian:12) | < 1:4.1.5-1 | 1:4.1.5-1 |
| debian/shadow(Debian:13) | < 1:4.1.5-1 | 1:4.1.5-1 |
| debian/shadow(Debian:14) | < 1:4.1.5-1 | 1:4.1.5-1 |
| debian/sudo(Debian:12) | < 1.7.4p4 | 1.7.4p4 |
| debian/sudo(Debian:13) | < 1.7.4p4 | 1.7.4p4 |
| debian/sudo(Debian:14) | < 1.7.4p4 | 1.7.4p4 |
| debian/shadow | >= 4.0.0, <= 4.1.5 | No fix listed |
| sudo project sudo | >= 1.3.0, <= 1.7.4 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| redhat enterprise linux | = 4 | No fix listed |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat shadow | = 4.x before 4.1.5 | No fix listed |
| redhat/sudo | = 1.x before 1.7.4 | No fix listed |
References
- Debian Security Tracker CVE-2005-4890 third-party-advisory vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com exploit mailing-list third-party-advisory
- access.redhat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking