6.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
43.1%
Debian Security Advisory DSA-3421-1 [email protected]
https://www.debian.org/security/ Luciano Bello
December 16, 2015 https://www.debian.org/security/faq
Package : grub2
CVE ID : CVE-2015-8370
Debian Bug : 807614
Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group,
found an integer underflow vulnerability in Grub2, a popular bootloader.
A local attacker can bypass the Grub2 authentication by inserting a
crafted input as username or password.
More information:
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
For the oldstable distribution (wheezy), this problem has been fixed
in version 1.99-27+deb7u3.
For the stable distribution (jessie), this problem has been fixed in
version 2.02~beta2-22+deb8u1.
For the unstable distribution (sid), this problem has been fixed in
version 2.02~beta2-33.
We recommend that you upgrade your grub2 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 8 | kfreebsd-i386 | grub-rescue-pc | < 2.02~beta2-22+deb8u1 | grub-rescue-pc_2.02~beta2-22+deb8u1_kfreebsd-i386.deb |
Debian | 8 | kfreebsd-i386 | grub-emu-dbg | < 2.02~beta2-22+deb8u1 | grub-emu-dbg_2.02~beta2-22+deb8u1_kfreebsd-i386.deb |
Debian | 7 | sparc | grub-common | < 1.99-27+deb7u3 | grub-common_1.99-27+deb7u3_sparc.deb |
Debian | 7 | i386 | grub-efi-amd64 | < 1.99-27+deb7u3 | grub-efi-amd64_1.99-27+deb7u3_i386.deb |
Debian | 6 | i386 | grub-common | < 1.98+20100804-14+squeeze2 | grub-common_1.98+20100804-14+squeeze2_i386.deb |
Debian | 8 | s390x | grub-mount-udeb | < 2.02~beta2-22+deb8u1 | grub-mount-udeb_2.02~beta2-22+deb8u1_s390x.deb |
Debian | 8 | i386 | grub-emu-dbg | < 2.02~beta2-22+deb8u1 | grub-emu-dbg_2.02~beta2-22+deb8u1_i386.deb |
Debian | 8 | amd64 | grub-ieee1275 | < 2.02~beta2-22+deb8u1 | grub-ieee1275_2.02~beta2-22+deb8u1_amd64.deb |
Debian | 8 | powerpc | grub-ieee1275-bin | < 2.02~beta2-22+deb8u1 | grub-ieee1275-bin_2.02~beta2-22+deb8u1_powerpc.deb |
Debian | 7 | sparc | grub2-common | < 1.99-27+deb7u3 | grub2-common_1.99-27+deb7u3_sparc.deb |