grub-mkconfig local access to password

2014.05.13
Credit: Seth
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-264


CVSS Base Score: 2.1/10
Impact Subscore: 2.9/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Hello Kurt, all, Please assign a CVE for grub-mkconfig. grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg configuration files if there are no plaintext passwords in the configuration file. However, the permissions are still set world readable if the password_pbkdf2 directive includes a hashed password. The original bug report and proposed patch is by Francesco Poli: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598 Original compressed patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598 Patch, uncompressed and inlined: diff -ruN a/grub-mkconfig b/grub-mkconfig --- a/grub-mkconfig 2011-05-31 11:33:31.000000000 +0200 +++ b/grub-mkconfig 2011-07-03 21:15:53.000000000 +0200 @@ -293,7 +293,7 @@ esac done -if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password " ${grub_cfg}.new ; then +if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password" ${grub_cfg}.new ; then chmod 444 ${grub_cfg}.new || true fi

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top