First Last Prev Next    This bug is not in your last search results.
Bug 40281 - grub2: CVE-2015-8370 (4.0)
grub2: CVE-2015-8370 (4.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P4 normal (vote)
: UCS 4.0-5-errata
Assigned To: Janek Walkenhorst
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2015-12-17 14:35 CET by Arvid Requate
Modified: 2016-06-01 17:28 CEST (History)
1 user (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-12-17 14:35:30 CET 
+++ This bug was initially created as a clone of Bug #40280 +++

The following issues have been identified in grub2:

* buffer overflow when checking password entered during bootup (CVE-2015-8370)

Fixed in wheezy version 1.99-27+deb7u3.
Comment 1 Stefan Gohmann univentionstaff 2016-04-19 15:35:48 CEST 
Move to 4.0-5-errata.
Comment 2 Janek Walkenhorst univentionstaff 2016-05-26 18:52:52 CEST 
r16546
 Upstream fix backported as
 grub2/4.0-0-0-ucs/2.00-18-errata4.0-5/CVE-2015-8370.patch

r69568 r69569
 Advisory:
 grub2.yaml
Comment 3 Janek Walkenhorst univentionstaff 2016-05-27 18:06:10 CEST 
How to reproduce:

--- /etc/grub.d/00_header
+++ /etc/grub.d/00_header
@@ -315,3 +315,8 @@
 if [ "x${GRUB_BADRAM}" != "x" ] ; then
   echo "badram ${GRUB_BADRAM}"
 fi
+
+cat <<EOF
+set superusers="benutzer"
+password benutzer univention
+EOF

update-grub
shutdown -r now
On username and password prompt press Backspace at least 28 times, before trying to enter the username or password.
Comment 4 Janek Walkenhorst univentionstaff 2016-05-27 19:24:25 CEST 
Advisories: grub2.yaml grub-efi-amd64-signed.yaml

QA: Please test UEFI boot (i.e. grub-efi-amd64-signed) too.

Tests (KVM BIOS i386/amd64): OK
Comment 5 Philipp Hahn univentionstaff 2016-05-31 15:32:16 CEST 
OK: amd64 @ kvm
OK: i386 @ kvm
 both did not crash bat did not accept correctly entered credentials - now works

FAIL: dpkg-query -W grub-common # 2.00-18.108.201605261835
 Version is older than 2.00-18.110.201605271548 in UCS-3.2-8 !

OK: zless /usr/share/doc/grub-common/changelog.Debian.gz

OK: errata-announce -V --only grub2.yaml
OK: errata-announce -V --only grub-efi-amd64-signed.yaml
FIXED: r69642 grub2.yaml grub-efi-amd64-signed.yaml

TODO: UEFI
Comment 6 Janek Walkenhorst univentionstaff 2016-05-31 18:49:54 CEST 
(In reply to Philipp Hahn from comment #5)
> FAIL: dpkg-query -W grub-common # 2.00-18.108.201605261835
>  Version is older than 2.00-18.110.201605271548 in UCS-3.2-8 !
Rebuilt as newer version.

Tests (KVM amd64): OK
Binary Diff: OK
Comment 7 Philipp Hahn univentionstaff 2016-06-01 11:02:08 CEST 
OK: dpkg-query -W grub-common grub2-common grub-pc grub-pc-bin # 2.00-18.111.201605311707
OK: zless /usr/share/doc/grub-common/changelog.Debian.gz

OK: amd64 @ kvm
OK: i386 @ kvm
OK: UEFI @ kvm
OK: UEFI+SB @ kvm <https://hutten.knut.univention.de/mediawiki/index.php/Diskussion:UEFI#UEFI>
First Last Prev Next    This bug is not in your last search results.