[gentoo-announce] [ GLSA 201512-03 ] GRUB: Authentication bypass

[news 28]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory GLSA 201512-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

https://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 

Severity: Normal

Title: GRUB: Authentication bypass

Date: December 19, 2015

Bugs: #568326

ID: 201512-03

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 

Synopsis

========

 

GRUB's authentication prompt can be bypassed by entering a sequence of

backspace characters.

 

Background

==========

 

GNU GRUB is a multiboot boot loader used by most Linux systems.

 

Affected packages

=================

 

-------------------------------------------------------------------

Package / Vulnerable / Unaffected

-------------------------------------------------------------------

1 sys-boot/grub < 2.02_beta2-r8 *>= 0.97 *

>= 2.02_beta2-r8 *

-------------------------------------------------------------------

NOTE: Packages marked with asterisks require manual intervention!

 

Description

===========

 

An integer underflow in GRUB's username/password authentication code

has been discovered.

 

Impact

======

 

An attacker with access to the system console may bypass the username

prompt by entering a sequence of backspace characters, allowing them

e.g. to get full access to GRUB's console or to load a customized

kernel.

 

Workaround

==========

 

There is no known workaround at this time.

 

Resolution

==========

 

All GRUB 2.x users should upgrade to the latest version:

 

# emerge --sync

# emerge --ask --oneshot --verbose ">=sys-boot/grub-2.02_beta2-r8"

 

After upgrading, make sure to run the grub2-install command with

options appropriate for your system. See the GRUB2 Quick Start guide in

the references below for examples. Your system will be vulnerable until

this action is performed.

 

References

==========

 

[ 1 ] CVE-2015-8370

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8370

[ 2 ] GRUB2 Quick Start guide

https://wiki.gentoo.org/wiki/GRUB2_Quick_Start

 

Availability

============

 

This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:

 

https://security.gentoo.org/glsa/201512-03

 

Concerns?

=========

 

Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users' machines is of utmost

importance to us. Any security concerns should be addressed to

security ( -at -) gentoo.org or alternatively, you may file a bug at

https://bugs.gentoo.org.

 

License

=======

 

Copyright 2015 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).

 

The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.

 

http://creativecommons.org/licenses/by-sa/2.5