Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

An update of the grub2 package has been released.

Fixes CVE-2015-8370.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the Solaris component of Oracle Sun     Systems Products Suite (subcomponent: Grub2). The     supported version that is affected is 11. Difficult to     exploit vulnerability requiring logon to Operating     System. Successful attack of this vulnerability can     result in unauthorized Operating System takeover     including arbitrary code execution. (CVE-2015-8370)

  - Vulnerability in the Solaris component of Oracle Sun     Systems Products Suite (subcomponent: Zones). The     supported version that is affected is 11. Easily     exploitable vulnerability requiring logon to Operating     System plus additional, multiple logins to components.
    Successful attack of this vulnerability can escalate     attacker privileges resulting in unauthorized read     access to a subset of Solaris accessible data.
    (CVE-2016-0618)

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an 'Off-by-two' or 'Out of bounds overwrite' memory error.

- Fix buffer overflows when reading username and password.
    (bsc#956631, CVE-2015-8370)

  - Check MS-DOS header to find PE file header. (bsc#954126)

  - Use dirname for copying Xen kernel and initrd to esp.
    (bsc#955493)

  - Fix reading password by grub2-mkpasswd-pbdk2 without     controlling tty. (bsc#954519)

  - Add luks, gcry_rijndael and gcry_sha1 to signed EFI     image to support LUKS partition in default setup.
    (bsc#917427, bsc#955609)

  - Expand list of grub.cfg search path in PV Xen guests for     systems installed on btrfs snapshots. (bsc#946148,     bsc#952539) This update was imported from the     SUSE:SLE-12-SP1:Update update project.

This update for grub2 provides the following fixes and enhancements :

Security issue fixed :

  - Fix buffer overflows when reading username and password.
    (bsc#956631, CVE-2015-8370)

Non security issues fixed :

  - Expand list of grub.cfg search path in PV Xen guests for     systems installed on btrfs snapshots. (bsc#946148,     bsc#952539)

  - Add --image switch to force zipl update to specific     kernel. (bsc#928131)

  - Do not use shim lock protocol for reading PE header as     it won't be available when secure boot is disabled.
    (bsc#943380)

  - Make firmware flaw condition be more precisely detected     and add debug message for the case.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix buffer overflows when reading username and password.
    (bsc#956631, CVE-2015-8370)

  - Check MS-DOS header to find PE file header. (bsc#954126)

  - Use dirname for copying Xen kernel and initrd to esp.
    (bsc#955493)

  - Fix reading password by grub2-mkpasswd-pbdk2 without     controlling tty. (bsc#954519)

  - Add luks, gcry_rijndael and gcry_sha1 to signed EFI     image to support LUKS partition in default setup.
    (bsc#917427, bsc#955609)

  - Expand list of grub.cfg search path in PV Xen guests for     systems installed on btrfs snapshots. (bsc#946148,     bsc#952539)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for grub2 provides the following fixes :

A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370)

Bugs fixed :

  - Expand list of grub.cfg search path in PV Xen guests for     systems installed on btrfs snapshots. (bsc#946148,     bsc#952539)

  - Add grub.xen config searching path on boot partition.
    (bsc#884828)

  - Add linux16 and initrd16 to grub.xen. (bsc#884830)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for grub2 provides the following fixes :

A security issues with a bufferoverflow when reading username and password was fixed (bsc#956631, CVE-2015-8370)

Also following bugs were fixed :

  - Fix buffer overflows when reading username and password.
    (bsc#956631, CVE-2015-8370)

  - Expand list of grub.cfg search path in PV Xen guests for     systems installed on btrfs snapshots. (bsc#946148,     bsc#952539)

  - Add grub.xen config searching path on boot partition.
    (bsc#884828)

  - Add linux16 and initrd16 to grub.xen. (bsc#884830)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for grub2 fixes the following issue :

Changes in grub2 :

  - CVE-2015-8370: Fix for overflow in grub_password_get and     grub_user_get functions (bnc#956631)

A flaw was found in the way the grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system.
(CVE-2015-8370)

This update also fixes the following bug :

  - When upgrading from Scientific Linux 7.1 and earlier, a     configured boot password was not correctly migrated to     the newly introduced user.cfg configuration files. This     could possibly prevent system administrators from     changing grub2 configuration during system boot even if     they provided the correct password. This update corrects     the password migration script and the incorrectly     generated user.cfg file.

The remote host is affected by the vulnerability described in GLSA-201512-03 (GRUB: Authentication bypass)

    An integer underflow in GRUB&rsquo;s username/password authentication code       has been discovered.
  Impact :

    An attacker with access to the system console may bypass the username       prompt by entering a sequence of backspace characters, allowing them e.g.
      to get full access to GRUB&rsquo;s console or to load a customized kernel.
  Workaround :

    There is no known workaround at this time.

New grub packages are available for Slackware 14.1 and -current to fix a security issue.

Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password.

More information:
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html CVE-2015-8370

Updated grub2 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

[Updated 27 January 2016] This advisory has been updated to document additional steps that need to be performed on BIOS-based systems after installing this update. No changes were made to the packages included in the advisory.

The grub2 packages provide version 2 of the Grand Unified Bootloader (GRUB), a highly configurable and customizable bootloader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

A flaw was found in the way the grub2 handled backspace characters entered in username and password prompts. An attacker with access to the system console could use this flaw to bypass grub2 password protection and gain administrative access to the system.
(CVE-2015-8370)

This update also fixes the following bug :

* When upgrading from Red Hat Enterprise Linux 7.1 and earlier, a configured boot password was not correctly migrated to the newly introduced user.cfg configuration files. This could possibly prevent system administrators from changing grub2 configuration during system boot even if they provided the correct password. This update corrects the password migration script and the incorrectly generated user.cfg file. (BZ#1290089)

All grub2 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For this update to take effect on BIOS-based machines, grub2 needs to be reinstalled as documented in the 'Reinstalling GRUB 2 on BIOS-Based Machines' section of the Red Hat Enterprise Linux 7 System Administrator's Guide linked to in the References section. No manual action is needed on UEFI-based machines.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2836-1 advisory.

    Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured     to use authentication. A local attacker could use this issue to bypass GRUB password protection.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2623 advisory.

    The grub2 packages provide version 2 of the Grand Unified Bootloader     (GRUB), a highly configurable and customizable bootloader with modular     architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    A flaw was found in the way the grub2 handled backspace characters entered     in username and password prompts. An attacker with access to the system     console could use this flaw to bypass grub2 password protection and gain     administrative access to the system. (CVE-2015-8370)

    This update also fixes the following bug:

    * When upgrading from Red Hat Enterprise Linux 7.1 and earlier, a     configured boot password was not correctly migrated to the newly introduced     user.cfg configuration files. This could possibly prevent system     administrators from changing grub2 configuration during system boot even if     they provided the correct password. This update corrects the password     migration script and the incorrectly generated user.cfg file. (BZ#1290089)

    All grub2 users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. For this update to take     effect on BIOS-based machines, grub2 needs to be reinstalled as documented     in the Reinstalling GRUB 2 on BIOS-Based Machines section of the Red Hat     Enterprise Linux 7 System Administrator's Guide linked to in the References     section. No manual action is needed on UEFI-based machines.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-2623 advisory.

    - Fix security issue when reading username and password       Resolves: CVE-2015-8370

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Hector Marco-Gisbert, from the Universitat Polit&egrave;cnica de Val&egrave;ncia Cybersecurity Team, reported a buffer overflow in grub2 when checking password during bootup.

For Debian 6 'Squeeze', this problem has been fixed in grub2 version 1.98+20100804-14+squeeze2. We recommend you to upgrade your grub2 packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
121648	Photon OS 1.0: Grub2 PHSA-2016-0012	Nessus	PhotonOS Local Security Checks	high
89415	Fedora 23 : grub2-2.02-0.25.fc23 (2015-cebe5133e7)	Nessus	Fedora Local Security Checks	medium
89324	Fedora 22 : grub2-2.02-0.18.fc22 (2015-90c27b6e91)	Nessus	Fedora Local Security Checks	medium
88003	Oracle Solaris Critical Patch Update : jan2016_SRU11_3_4_5_0	Nessus	Solaris Local Security Checks	medium
87904	F5 Networks BIG-IP : GRUB2 vulnerability (SOL25901386)	Nessus	F5 Networks Local Security Checks	medium
87772	openSUSE Security Update : grub2 (openSUSE-2016-10)	Nessus	SuSE Local Security Checks	medium
87722	SUSE SLED12 / SLES12 Security Update : grub2 (SUSE-SU-2015:2399-1)	Nessus	SuSE Local Security Checks	medium
87670	SUSE SLED12 / SLES12 Security Update : grub2 (SUSE-SU-2015:2387-1)	Nessus	SuSE Local Security Checks	medium
87669	SUSE SLED11 / SLES11 Security Update : grub2 (SUSE-SU-2015:2386-1)	Nessus	SuSE Local Security Checks	medium
87668	SUSE SLED11 / SLES11 Security Update : grub2 (SUSE-SU-2015:2385-1)	Nessus	SuSE Local Security Checks	medium
87630	openSUSE Security Update : grub2 (openSUSE-2015-957)	Nessus	SuSE Local Security Checks	medium
87586	Scientific Linux Security Update : grub2 on SL7.x x86_64 (20151215)	Nessus	Scientific Linux Local Security Checks	medium
87516	GLSA-201512-03 : GRUB: Authentication bypass	Nessus	Gentoo Local Security Checks	medium
87477	Slackware 14.1 / current : grub (SSA:2015-351-01)	Nessus	Slackware Local Security Checks	medium
87428	Debian DSA-3421-1 : grub2 - security update	Nessus	Debian Local Security Checks	medium
87422	CentOS 7 : grub2 (CESA-2015:2623)	Nessus	CentOS Local Security Checks	medium
87408	Ubuntu 14.04 LTS : GRUB vulnerability (USN-2836-1)	Nessus	Ubuntu Local Security Checks	critical
87397	RHEL 7 : grub2 (RHSA-2015:2623)	Nessus	Red Hat Local Security Checks	high
87395	Oracle Linux 7 : grub2 (ELSA-2015-2623)	Nessus	Oracle Linux Local Security Checks	high
87330	Debian DLA-368-1 : grub2 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-8370

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

high

high

medium