CVE Request: grub-mkconfig

[Seth Arnold <seth.arnold () canonical com>]

Hello Kurt, all,

Please assign a CVE for grub-mkconfig.

grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg
configuration files if there are no plaintext passwords in the
configuration file. However, the permissions are still set world readable
if the password_pbkdf2 directive includes a hashed password.

The original bug report and proposed patch is by Francesco Poli:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598

Original compressed patch:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598

Patch, uncompressed and inlined:

diff -ruN a/grub-mkconfig b/grub-mkconfig
--- a/grub-mkconfig     2011-05-31 11:33:31.000000000 +0200
+++ b/grub-mkconfig     2011-07-03 21:15:53.000000000 +0200
@@ -293,7 +293,7 @@
   esac
 done
 
-if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password " ${grub_cfg}.new ; then
+if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password" ${grub_cfg}.new ; then
   chmod 444 ${grub_cfg}.new || true
 fi
 



Thanks

Attachment: signature.asc
Description: Digital signature