[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 14 Nov 2013 20:33:43 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, security@...ntu.com
Subject: Re: CVE Request: grub-mkconfig
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/14/2013 05:04 PM, Seth Arnold wrote:
> Hello Kurt, all,
>
> Please assign a CVE for grub-mkconfig.
>
> grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg
> configuration files if there are no plaintext passwords in the
> configuration file. However, the permissions are still set world
> readable if the password_pbkdf2 directive includes a hashed
> password.
>
> The original bug report and proposed patch is by Francesco Poli:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598
>
> Original compressed patch:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598
>
> Patch, uncompressed and inlined:
>
> diff -ruN a/grub-mkconfig b/grub-mkconfig --- a/grub-mkconfig
> 2011-05-31 11:33:31.000000000 +0200 +++ b/grub-mkconfig 2011-07-03
> 21:15:53.000000000 +0200 @@ -293,7 +293,7 @@ esac done
>
> -if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password "
> ${grub_cfg}.new ; then +if [ "x${grub_cfg}" != "x" ] && ! grep -q
> "^password" ${grub_cfg}.new ; then chmod 444 ${grub_cfg}.new ||
> true fi
>
>
>
>
> Thanks
>
Please use CVE-2013-4577 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBAgAGBQJShZYWAAoJEBYNRVNeJnmTtykQANfZ6n3UlaLWAUa2BzT5+rIS
YOOa7/F2cftHK/7zpGqAe50ZI4pB+Vq9PGIoi2exh5ulVxXpe3Gu8DbUOj4NoHVg
sZ47rJMJThs+LG1TLNLP5VcyrBDHOHBRL2y0wBeDn4dftw1Tz+w+rBXInzSxIcxk
W8RjA+OM+CoT+qAeGIvCXc5BZcQ59vVzVSD1qvJLIkf1GaZD+8zeYr4KwrlYY+Za
P74QxC6yX0fhQ2AltxLaqMeHakRAVeuTddrP4VtOX0WcURizrVqfGCLPp90THADm
emVrhR032IpTapY0voX+c5n9qipvitvbl9h3XDpWDBFluSNZ5NRjOxgWajSq4rAg
PT7MUia1GkRyhfMVnmGT85cbET3/CdFkzKH+tuV7+E6tJhlvcTYHHBkslGjGK8fX
KPX9BCxgOx+1HPpzTZnTNTxBsDkBurmW5JK4VG6H+Z3zJuXobnuNn90bItHVMz1t
B/isfHRLHo8WbgvdJ4GQxuByOmVHuMv7BqrJpus6Wuavph7m6VMFaKRwKKUtwzOm
JocjPrZ3nBh8GEmrLdhktUhtsRqLFOyjL6wNB/KRdZyy2lAK7/srn+o+x7DwHweh
9goCkSLkCoM/GDehg5hEIR4YWDsEvdGGeMaUCk2XHGvQ3kC1EfhZnIRcfyxtHAVe
cFwckbOjqim5oHW9h9Fg
=DSXv
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
