cve/2005/CVE-2005-4890.md

### [CVE-2005-4890](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4890)
![](https://img.shields.io/static/v1?label=Product&message=shadow&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=sudo&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%201.x%20before%201.7.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%204.x%20before%204.1.5%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=tty%20hijacking%20possible%20in%20%22su%22%20via%20TIOCSTI%20ioctl&color=brighgreen)

### Description

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

### POC

#### Reference
- http://www.openwall.com/lists/oss-security/2014/10/20/9
- http://www.openwall.com/lists/oss-security/2014/10/21/1

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/RouzanXploitSec47/sudo
- https://github.com/agnostic-apollo/sudo
- https://github.com/fokypoky/places-list
- https://github.com/hartwork/antijack