CVE-2017-20002

Katalog CVE

CVSS 7.8 · High EPSS 0,40%

Kerentanan Improper Privilege Management pada debian shadow, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.

Rincian

Terbit di NVD

17 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374 mailing list · advisory vendor
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957 exploit · mailing list · advisory vendor
• https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html mailing list · advisory vendor