CVE-2005-4890: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2005-4890 is a high (CVSS 7.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-11-2019PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian4 products
- shadow< 1:4.1.5-1
- sudo< 1.7.4p4
- debian_linuxEOL8.0 | 9.0 | 10.0
- shadow≥ 4.0.0, ≤ 4.1.5
Redhat1 product
- enterprise_linuxEOL4 | 5 | 6.0
Sudo_project1 product
- sudo≥ 1.3.0, ≤ 1.7.4
Ubuntu1 product
- shadow< 1:4.1.5.1-1ubuntu9
5 vendors · 9 products
References
17 links
Show all 17 references
- www.openwall.com/lists/oss-security/2016/02/25/6X Refsource MISCExploitMailing ListThird Party Advisory