GRUB: Authentication bypass

Background GNU GRUB is a multiboot boot loader used by most Linux systems. Description An integer underflow in GRUB’s username/password authentication code has been discovered. Impact An attacker with access to the system console may bypass the username prompt by entering a sequence of backspace...

[slackware-security] grub

New grub packages are available for Slackware 14.1 and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/grub-2.00-i486-3slack14.1.txz: Rebuilt. Patched bug where password protection during system startup may be bypassed by hitting the...

Slackware 14.1 / current : grub (SSA:2015-351-01)

New grub packages are available for Slackware 14.1 and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2015-351-01. The text itself is copyright C Slackwar...

[SECURITY] Fedora 22 Update: grub2-2.02-0.18.fc22

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

DEBIAN-CVE-2015-8370

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service disk corruption via backspace characters in the 1 grubusernameget function in grub-core/normal/auth.c or the 2...

Ubuntu 14.04 LTS : GRUB vulnerability (USN-2836-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2836-1 advisory. Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this...

RedHat Update for grub2 RHSA-2015:2623-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2836-1: GRUB vulnerability

Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this issue to bypass GRUB password protection...

USN-2836-1 grub2 vulnerability

Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this issue to bypass GRUB password protection...

grub2: buffer overflow when checking password entered during bootup

A flaw was found in the way grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system...

The vulnerability of the Red Hat Enterprise Linux operating system allows a hacker to bypass security restrictions and execute arbitrary code.

The vulnerability of the grub2 loader in the Red Hat Enterprise Linux operating system is related to deficiencies in access control for files. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary code using a specially created multiboot or...

[SECURITY] Fedora 23 Update: grub2-2.02-0.25.fc23

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

UBUNTU-CVE-2015-8370

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service disk corruption via backspace characters in the 1 grubusernameget function in grub-core/normal/auth.c or the 2...

PT-2015-2904 · Gnu +4 · Grub2 +4

Name of the Vulnerable Software and Affected Versions: Grub2 versions 1.98 through 2.02 Description: The issue is caused by multiple integer underflows that allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service disk corruption...

[SECURITY] Fedora 22 Update: grub2-2.02-0.17.fc22

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

grub2 security update

CentOS Errata and Security Advisory CESA-2015:2401 Updated grub2 packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scori...

[SECURITY] Fedora 23 Update: grub2-2.02-0.24.fc23

The GRand Unified Bootloader GRUB is a highly configurable and customizab le bootloader with modular architecture. It support rich varietyof kernel for mats, file systems, computer architectures and hardware devices. This subpackage provides support for PC BIOS systems...

grub2: modules built in on EFI builds that allow loading arbitrary code, circumventing secure boot

It was discovered that grub2 builds for EFI systems contained modules that were not suitable to be loaded in a Secure Boot environment. An attacker could use this flaw to circumvent the Secure Boot mechanisms and load non-verified code. Attacks could use the boot menu if no password was set, or t...

CVE-2013-4577

A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the passwordpbkdf2 directive in the file...

CVE-2008-3896

Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer...