### [CVE-2005-4890](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4890)
![](https://img.shields.io/static/v1?label=Product&message=shadow&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=sudo&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.x%20before%201.7.4%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=4.x%20before%204.1.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=tty%20hijacking%20possible%20in%20%22su%22%20via%20TIOCSTI%20ioctl&color=brightgreen)

### Description

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

### POC

#### Reference
- http://www.openwall.com/lists/oss-security/2014/10/20/9
- http://www.openwall.com/lists/oss-security/2014/10/21/1

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Dariani223/DevOpsFinal
- https://github.com/RouzanXploitSec47/sudo
- https://github.com/Telooss/TP-WIK-DPS-TP02
- https://github.com/agnostic-apollo/sudo
- https://github.com/aklavya20/network-analyzer
- https://github.com/aklavya20/nuclear
- https://github.com/aklavya20/server-analyzer
- https://github.com/aklavya20/sudo
- https://github.com/ashrea06/Zeek-Suricata-Inline-TAP
- https://github.com/ashrea06/Zeek.Suricata_NIDS
- https://github.com/emseh/rails-on-termux
- https://github.com/fokypoky/places-list
- https://github.com/hartwork/antijack
- https://github.com/mmbazm/secure_license_server
- https://github.com/poikl246/DevSecOps-2024-v2