Test ID:	1.3.6.1.4.1.25623.1.0.703421
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3421-1 (grub2 - security update)
Summary:	Hector Marco and Ismael Ripoll, from;Cybersecurity UPV Research Group, found an integer underflow vulnerability in;Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication;by inserting a crafted input as username or password.
Description:	Summary: Hector Marco and Ismael Ripoll, from Cybersecurity UPV Research Group, found an integer underflow vulnerability in Grub2, a popular bootloader. A local attacker can bypass the Grub2 authentication by inserting a crafted input as username or password. Affected Software/OS: grub2 on Debian Linux Solution: For the oldstable distribution (wheezy), this problem has been fixed in version 1.99-27+deb7u3. For the stable distribution (jessie), this problem has been fixed in version 2.02~ beta2-22+deb8u1. For the unstable distribution (sid), this problem has been fixed in version 2.02~ beta2-33. We recommend that you upgrade your grub2 packages. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-8370 BugTraq ID: 79358 http://www.securityfocus.com/bid/79358 Bugtraq: 20151215 Back to 28: Grub2 Authentication Bypass 0-Day [CVE-2015-8370] (Google Search) http://www.securityfocus.com/archive/1/537115/100/0/threaded Debian Security Information: DSA-3421 (Google Search) http://www.debian.org/security/2015/dsa-3421 http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html http://seclists.org/fulldisclosure/2015/Dec/69 https://security.gentoo.org/glsa/201512-03 http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html http://www.openwall.com/lists/oss-security/2015/12/15/6 RedHat Security Advisories: RHSA-2015:2623 http://rhn.redhat.com/errata/RHSA-2015-2623.html http://www.securitytracker.com/id/1034422 SuSE Security Announcement: SUSE-SU-2015:2385 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html SuSE Security Announcement: SUSE-SU-2015:2386 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html SuSE Security Announcement: SUSE-SU-2015:2387 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html SuSE Security Announcement: SUSE-SU-2015:2399 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html SuSE Security Announcement: openSUSE-SU-2015:2375 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html SuSE Security Announcement: openSUSE-SU-2015:2392 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html SuSE Security Announcement: openSUSE-SU-2016:0036 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html http://www.ubuntu.com/usn/USN-2836-1
Copyright	Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.