- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Zero-Day GRUB2 Vulnerability Hits Linux Users, Patch Available for Ubuntu, RHEL
The security flaw was discovered by developers Ismael Ripoll and Hector Marco in the upstream GRUB2 packages, which did not correctly handled the backspace key when the bootloader was configured to use password protected authentication, thus allowing a local attacker to bypass GRUB's password protection. |
|
|
Comments (5)
It appears that the author doesn't know that not every distribution defaults to using Grub.
That's true, and also notice that this issue applies only to the case where physical access is available.
Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk. I recently set up dual boot on 25 classroom systems completely without the need to log into an administrator account on the Windows side and had full access to the contents of the Windows file system while doing it. So Windows systems, Linux systems and Mac systems are all vulnerable whenever physical access is available.
We should all remember to keep our systems physically secure, and if a system is physically secure then this grub2 issue is irrelevant.
Aside from that, this is FOSS and the bug will be fixed immediately.
You can be on your way, these are not the droids you're looking for...
Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk. I recently set up dual boot on 25 classroom systems completely without the need to log into an administrator account on the Windows side and had full access to the contents of the Windows file system while doing it. So Windows systems, Linux systems and Mac systems are all vulnerable whenever physical access is available.
We should all remember to keep our systems physically secure, and if a system is physically secure then this grub2 issue is irrelevant.
Aside from that, this is FOSS and the bug will be fixed immediately.
You can be on your way, these are not the droids you're looking for...
> Physical access has always meant access regardless of the OS running on that machine as long as the bios is set to permit booting from a live disk.
And if you can enter the bios and change the settings, even then.
As others have stated before, if you don't have physical security, you don't have security.
And if you can enter the bios and change the settings, even then.
As others have stated before, if you don't have physical security, you don't have security.
By dropping into GRUB's command prompt, you can boot a variety of things from a variety of locations. On a system configured to only boot the GRUB device it is possible to boot something not already in the menu.
Although, in all the years I've been using GRUB Legacy/2 (reading documentation, manual configuration, various OS installations, even compiling an EFI version to boot LFS), I never knew password protection was available. I've never encountered it in the wild.
Although, in all the years I've been using GRUB Legacy/2 (reading documentation, manual configuration, various OS installations, even compiling an EFI version to boot LFS), I never knew password protection was available. I've never encountered it in the wild.
Quoting:this issue applies only to the case where physical access is availableand where grub is actually protected by a password.
Quoting:I never knew password protection was available. I've never encountered it in the wild
it's like worrying about breaking the lock on an open door.
greetings, eMBee.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post