Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-20002 Details

Description

The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374	CVE	Mailing ListVendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957	CVE	ExploitMailing ListVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html	CVE	Mailing ListVendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374	[email protected]	Mailing ListVendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957	[email protected]	ExploitMailing ListVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html	[email protected]	Mailing ListVendor Advisory

see all 6 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-269	Improper Privilege Management	[email protected]

Affected Products

Product	Versions
debian shadow	4.4
CPE cpe:2.3:a:debian:shadow:4.4:::::::* Remediation No remediation found in references.
debian debian linux	9.0
CPE cpe:2.3:o:debian:debian_linux:9.0:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jun 7, 2021	Reanalysis	[email protected]
Mar 23, 2021	Initial Analysis	[email protected]
Mar 18, 2021	CVE Modified	[email protected]
Mar 17, 2021	CVE Modified	[email protected]