CVE-2017-20002: Vulnerability in Debian login package
Summary
CVE-2017-20002: The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. Affects shadow across 2 version ranges.
< 1:4.5-1
< 68061f2059124f5aa450dfbf6bbad3e7a6f65f9f
Fixed in 1:4.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The login package is a part of the Debian operating system and is responsible for handling user logins. It provides the functionality for users to authenticate and access the system. The vulnerability in the Debian login package allows local users to login as password-less users, even if they are connected by non-physical means such as SSH. This bypasses the PAM's nullok_secure configuration and can lead to privilege escalation. This vulnerability is particularly significant in environments like virtual machines with default blank root passwords.
Vulnerability Detail
The Debian shadow package before version 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This misconfiguration allows local users to login as password-less users, bypassing PAM's nullok_secure configuration. As a result, users can escalate their privileges and gain unauthorized access to the system. This vulnerability is especially critical in scenarios where virtual machines are automatically generated with default blank root passwords, enabling all local users to exploit the vulnerability.
How To Fix
Minimum fixed version
1:4.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade shadowTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Debian login package allows local users to login as password-less users and escalate their privileges. It is crucial to upgrade the package to the fixed version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shadow →
FAQ
The vulnerability allows local users to login as password-less users and escalate their privileges, potentially gaining unauthorized access to the system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file, like package-lock.json, and Vulert will analyze it in real-time.
There are no known exploits available for this vulnerability at the moment.
No, this vulnerability can only be exploited by local users who have access to the system.
Yes, the CVSS score for this vulnerability is 7.8, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for shadow.
