CVE-2017-20002

7.8HIGH

Key Information

Vendor
Debian
Status
Debian Linux
Shadow
Vendor
CVE Published:
17 March 2021

Summary

The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374
x_refsource_MISC
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957
x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/03/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.