p PatchFirst

CVE-2005-4890

CVE-2005-4890

This page contains facts from public vulnerability sources. Check the original advisory before updating.

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

CVSS 7.8 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • shadow

    Versions
    • 4.x before 4.1.5: Affected

    No fix published

  • sudo

    Versions
    • 1.x before 1.7.4: Affected

    No fix published

  • shadow Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.1.5-1

    Update to 1:4.1.5-1

  • shadow Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.1.5-1

    Update to 1:4.1.5-1

  • shadow Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.1.5-1

    Update to 1:4.1.5-1

  • sudo Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.7.4p4

    Update to 1.7.4p4

  • sudo Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.7.4p4

    Update to 1.7.4p4

  • sudo Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.7.4p4

    Update to 1.7.4p4

Original sources

Check your server →