Advanced

Well, some Linux users.

Story: Zero-Day GRUB2 Vulnerability Hits Linux Users, Patch Available for Ubuntu, RHELTotal Replies: 4
Author Content
jdixon

Dec 16, 2015
8:38 AM EST 		It appears that the author doesn't know that not every distribution defaults to using Grub.
penguinist

Dec 16, 2015
9:24 AM EST 		That's true, and also notice that this issue applies only to the case where physical access is available.

Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk. I recently set up dual boot on 25 classroom systems completely without the need to log into an administrator account on the Windows side and had full access to the contents of the Windows file system while doing it. So Windows systems, Linux systems and Mac systems are all vulnerable whenever physical access is available.

We should all remember to keep our systems physically secure, and if a system is physically secure then this grub2 issue is irrelevant.

Aside from that, this is FOSS and the bug will be fixed immediately.

You can be on your way, these are not the droids you're looking for...
jdixon

Dec 16, 2015
3:08 PM EST 		> Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk.

And if you can enter the bios and change the settings, even then.

As others have stated before, if you don't have physical security, you don't have security.
cybertao

Dec 17, 2015
2:02 AM EST 		By dropping into GRUB's command prompt, you can boot a variety of things from a variety of locations. On a system configured to only boot the GRUB device it is possible to boot something not already in the menu.

Although, in all the years I've been using GRUB Legacy/2 (reading documentation, manual configuration, various OS installations, even compiling an EFI version to boot LFS), I never knew password protection was available. I've never encountered it in the wild.
mbaehrlxer

Dec 19, 2015
3:22 AM EST
Quoting:this issue applies only to the case where physical access is available
and where grub is actually protected by a password.

Quoting:I never knew password protection was available. I've never encountered it in the wild


it's like worrying about breaking the lock on an open door.

greetings, eMBee.

Post a reply to this thread:

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post