Description
Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands by sending characters to a shell process on the same termimal via the TIOCSTI ioctl.
References
- http://plash.beasts.org/wiki/PlashIssues/TtyVulnerability
- 22892 vdb-entry
- 24498 third-party-advisory
- ADV-2007-0909 vdb-entry
- 32598 vdb-entry
- [plash] 20070301 TTY ioctl() vulnerability mailing-list