Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password. More information: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html CVE-2015-8370 For the oldstable distribution (wheezy), this problem has been fixed in version 1.99-27+deb7u3. For the stable distribution (jessie), this problem has been fixed in version 2.02~beta2-22+deb8u1. For the unstable distribution (sid), this problem has been fixed in version 2.02~beta2-33. We recommend that you upgrade your grub2 packages.
Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password.
More information:
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
CVE-2015-8370
For the oldstable distribution (wheezy), this problem has been fixed in version 1.99-27+deb7u3.
For the stable distribution (jessie), this problem has been fixed in version 2.02~beta2-22+deb8u1.
For the unstable distribution (sid), this problem has been fixed in version 2.02~beta2-33.
We recommend that you upgrade your grub2 packages.
Vulmon