7.2 - USN-868-1

Executive Summary

Summary
Title	GRUB 2 vulnerability

Informations
Name	USN-868-1	First vendor Publication	2009-12-09
Vendor	Ubuntu	Last vendor Modification	2009-12-09
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	7.2	Attack Range	Local
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	3.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 9.10:
grub2 1.97~beta4-1ubuntu4.1

In general, a standard system upgrade is sufficient to effect the necessary changes.

Users who have upgraded from GRUB Legacy to GRUB 2 and are still using Grub Legacy to chainload into GRUB 2, you will have to run the following command (possibly adjusting 'hd0') to update GRUB 2's on disk core image:

$ sudo grub-install --no-floppy --grub-setup=/bin/true "(hd0)"

If you previously ran 'upgrade-from-grub-legacy', a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

It was discovered that GRUB 2 did not properly validate passwords. An attacker with physical access could conduct a brute force attack and bypass authentication by submitting a 1 character password.