It was discovered that GRUB 2 did not properly validate passwords. An attacker with physical access could conduct a brute force attack and bypass authentication by submitting a 1 character password.
The problem can be corrected by updating your system to the following package versions:
9 December 2009
A security issue affects these releases of Ubuntu and its derivatives:
It was discovered that GRUB 2 did not properly validate passwords. An attacker with physical access could conduct a brute force attack and bypass authentication by submitting a 1 character password.
The problem can be corrected by updating your system to the following package versions:
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system upgrade is sufficient to effect the necessary changes.
Users who have upgraded from GRUB Legacy to GRUB 2 and did not run ‘upgrade-from-grub-legacy’ (ie those who are still using Grub Legacy to chainload into GRUB 2) will have to run the following command (possibly adjusting ‘hd0’) to update GRUB 2’s on disk core image:
$ sudo grub-install –no-floppy –grub-setup=/bin/true “(hd0)”
Vulmon