Debian Shadow Package Vulnerability in Physical Terminal Listing

CVE-2017-20002

What is CVE-2017-20002?

The Debian shadow package prior to version 1:4.5-1 displays a misconfiguration in /etc/securetty, incorrectly designating pts/0 and pts/1 as physical terminals. This flaw allows local users to bypass authentication mechanisms when accessing the system via non-physical means such as SSH. As a result, users can exploit this vulnerability to gain unauthorized access and potentially escalate their privileges, particularly in environments like virtual machines that may be configured with insecure default settings, such as a blank root password.

References