UBUNTU-CVE-2005-4890

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2005-4890
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2005/UBUNTU-CVE-2005-4890.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2005-4890
Upstream
Withdrawn
2025-07-18T16:42:37Z
Published
2019-11-04T19:15:00Z
Modified
2025-07-16T08:10:25.120040Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - low
Summary
[none]
Details

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

References

Affected packages

Ubuntu:14.04:LTS / shadow

Package

Name
shadow
Purl
pkg:deb/ubuntu/shadow@1:4.1.5.1-1ubuntu9?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.5.1-1ubuntu9

Affected versions

1:4.*
1:4.1.5.1-1ubuntu6
1:4.1.5.1-1ubuntu7
1:4.1.5.1-1ubuntu8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1:4.1.5.1-1ubuntu9",
            "binary_name": "login"
        },
        {
            "binary_version": "1:4.1.5.1-1ubuntu9",
            "binary_name": "passwd"
        },
        {
            "binary_version": "1:4.1.5.1-1ubuntu9",
            "binary_name": "uidmap"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2005/UBUNTU-CVE-2005-4890.json"