CVE-2005-4890

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-04 · updated 2026-06-16
Weakness: CWE-20

Description

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

Affected products

Debian Linux: 8.0, 9.0, 10.0
Debian Shadow: from 4.0.0 through 4.1.5
Red Hat Enterprise Linux: 4, 5, 6.0
sudo: from 1.3.0 through 1.7.4

References

http://www.openwall.com/lists/oss-security/2012/11/06/8
http://www.openwall.com/lists/oss-security/2013/05/20/3
http://www.openwall.com/lists/oss-security/2013/11/28/10
http://www.openwall.com/lists/oss-security/2013/11/29/5
http://www.openwall.com/lists/oss-security/2014/10/20/9
http://www.openwall.com/lists/oss-security/2014/10/21/1
http://www.openwall.com/lists/oss-security/2014/12/15/5
http://www.openwall.com/lists/oss-security/2016/02/25/6
https://access.redhat.com/security/cve/cve-2005-4890
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890
https://security-tracker.debian.org/tracker/CVE-2005-4890
http://www.openwall.com/lists/oss-security/2012/11/06/8

Get alerted when CVE-2005-4890 or the next vulnerability affects your stack