CVE-2005-4890
published 2019-11-04CVE-2005-4890: There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.64%
46.7th percentile
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | shadow | < shadow 1:4.1.5-1 (bookworm) | shadow 1:4.1.5-1 (bookworm) |
| debian | shadow | 4.0.0 – 4.1.5 | — |
| debian | sudo | < shadow 1:4.1.5-1 (bookworm) | shadow 1:4.1.5-1 (bookworm) |
| red_hat | shadow | — | — |
| red_hat | sudo | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| shadow_project | shadow | >= 0 < 1:4.1.5-1 | 1:4.1.5-1 |
| shadow_project | shadow | >= 0 < 1:4.1.5-1 | 1:4.1.5-1 |
| shadow_project | shadow | >= 0 < 1:4.1.5-1 | 1:4.1.5-1 |
| shadow_project | shadow | >= 0 < 1:4.1.5-1 | 1:4.1.5-1 |
| sudo_project | sudo | >= 0 < 1.7.4p4 | 1.7.4p4 |
| sudo_project | sudo | >= 0 < 1.7.4p4 | 1.7.4p4 |
| sudo_project | sudo | >= 0 < 1.7.4p4 | 1.7.4p4 |
| sudo_project | sudo | >= 0 < 1.7.4p4 | 1.7.4p4 |
| sudo_project | sudo | 1.3.0 – 1.7.4 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2005-4890: shadow - There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before...
vendor_debian·2005·CVSS 7.8
CVE-2005-4890 [HIGH] CVE-2005-4890: shadow - There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before...
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
Scope: local
bookworm: resolved (fixed in 1:4.1.5-1)
bullseye: resolved (fixed in 1:4.1.5-1)
forky: resolved (fixed in 1:4.1.5-1)
sid: resolved (fixed in 1:4.1.5-1)
trixie: resolved (fixed in 1:4.1.5-1)
Red Hat
coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
vendor_redhat·2004-07-26·CVSS 7.8
CVE-2005-4890 [HIGH] coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
Statement: This issue affects the version of coreutils package, as shipped with Red Hat Enterprise Linux 4. Red Hat Enterprise Linux 4 is however in the Extended Life Cycle Support (ELS) phase. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Package: coreutils (Red Hat Enterprise Linux 4) - Will not fix
Pac
GHSA
GHSA-3p48-pw9r-4325: There is a possible tty hijacking in shadow 4
ghsa_unreviewed·2022-04-21
CVE-2005-4890 [HIGH] CWE-20 GHSA-3p48-pw9r-4325: There is a possible tty hijacking in shadow 4
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
OSV
CVE-2005-4890: There is a possible tty hijacking in shadow 4
osv·2019-11-04·CVSS 7.8
CVE-2005-4890 [HIGH] CVE-2005-4890: There is a possible tty hijacking in shadow 4
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
No detection rules found.
No public exploits indexed.
Bugzilla
pkexec tty hijacking via TIOCSTI ioctl
bugzilla·2016-01-19·CVSS 7.8
CVE-2005-4890 [HIGH] pkexec tty hijacking via TIOCSTI ioctl
pkexec tty hijacking via TIOCSTI ioctl
When executing a program via "pkexec --user nonpriv program" the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing privilege escalation.
This issue has been fixed in "su" CVE-2005-4890 by calling setsid() and in "sudo" by using the "use_pty" flag.
$ cat test.c
#include
int main()
{
char *cmd = "id\n";
while(*cmd)
ioctl(0, TIOCSTI, cmd++);
}
$ gcc test.c -o test
$ id
uid=1000(saken) gid=1000(saken) groups=1000(saken)
# pkexec --user saken ./test ----> last command i type in
id
# id ----> did not type this
uid=0(root) gid=0(root) groups=0(root)
Discussion:
You have to possess CAP_SYS_ADMIN to successfully invoke the TIOCSTI ioctl. That implies to me that pkexe
Bugzilla
CVE-2005-4890 coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
bugzilla·2011-06-02·CVSS 7.8
CVE-2005-4890 [HIGH] CVE-2005-4890 coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
CVE-2005-4890 coreutils: tty hijacking possible in "su" via TIOCSTI ioctl
Quoting first paragraph from [1]:
https://bugzilla.redhat.com/show_bug.cgi?id=173008
for issue description:
When starting a program via "su - user -c program" the user session can escape
to the parent session by using the TIOCSTI ioctl to push characters into the
input buffer. This allows for example a non-root session to push
"chmod 666 /etc/shadow" or similarly bad commands into the input buffer such
that after the end of the session they are executed.
References:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=173008
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628843
Discussion:
This issue affects the version of the coreutils package, as shipped with
Red Hat Enterprise Linux 4.
--
This issue did NO
http://www.openwall.com/lists/oss-security/2012/11/06/8http://www.openwall.com/lists/oss-security/2013/05/20/3http://www.openwall.com/lists/oss-security/2013/11/28/10http://www.openwall.com/lists/oss-security/2013/11/29/5http://www.openwall.com/lists/oss-security/2014/10/20/9http://www.openwall.com/lists/oss-security/2014/10/21/1http://www.openwall.com/lists/oss-security/2014/12/15/5http://www.openwall.com/lists/oss-security/2016/02/25/6https://access.redhat.com/security/cve/cve-2005-4890https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890https://security-tracker.debian.org/tracker/CVE-2005-4890http://www.openwall.com/lists/oss-security/2012/11/06/8http://www.openwall.com/lists/oss-security/2013/05/20/3http://www.openwall.com/lists/oss-security/2013/11/28/10http://www.openwall.com/lists/oss-security/2013/11/29/5http://www.openwall.com/lists/oss-security/2014/10/20/9http://www.openwall.com/lists/oss-security/2014/10/21/1http://www.openwall.com/lists/oss-security/2014/12/15/5http://www.openwall.com/lists/oss-security/2016/02/25/6https://access.redhat.com/security/cve/cve-2005-4890https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2005-4890https://security-tracker.debian.org/tracker/CVE-2005-4890
2019-11-04
Published