Re: CVE Request: grub-mkconfig

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/14/2013 05:04 PM, Seth Arnold wrote:
> Hello Kurt, all,
>
> Please assign a CVE for grub-mkconfig.
>
> grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg 
> configuration files if there are no plaintext passwords in the 
> configuration file. However, the permissions are still set world
> readable if the password_pbkdf2 directive includes a hashed
> password.
>
> The original bug report and proposed patch is by Francesco Poli:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632598
>
> Original compressed patch:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=safer_grub_cfg_perms.diff.gz;att=1;bug=632598
>
>  Patch, uncompressed and inlined:
>
> diff -ruN a/grub-mkconfig b/grub-mkconfig --- a/grub-mkconfig
> 2011-05-31 11:33:31.000000000 +0200 +++ b/grub-mkconfig       2011-07-03
> 21:15:53.000000000 +0200 @@ -293,7 +293,7 @@ esac done
>
> -if [ "x${grub_cfg}" != "x" ] && ! grep -q "^password "
> ${grub_cfg}.new ; then +if [ "x${grub_cfg}" != "x" ] && ! grep -q
> "^password" ${grub_cfg}.new ; then chmod 444 ${grub_cfg}.new ||
> true fi
>
>
>
>
> Thanks

Please use CVE-2013-4577 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJShZYWAAoJEBYNRVNeJnmTtykQANfZ6n3UlaLWAUa2BzT5+rIS
YOOa7/F2cftHK/7zpGqAe50ZI4pB+Vq9PGIoi2exh5ulVxXpe3Gu8DbUOj4NoHVg
sZ47rJMJThs+LG1TLNLP5VcyrBDHOHBRL2y0wBeDn4dftw1Tz+w+rBXInzSxIcxk
W8RjA+OM+CoT+qAeGIvCXc5BZcQ59vVzVSD1qvJLIkf1GaZD+8zeYr4KwrlYY+Za
P74QxC6yX0fhQ2AltxLaqMeHakRAVeuTddrP4VtOX0WcURizrVqfGCLPp90THADm
emVrhR032IpTapY0voX+c5n9qipvitvbl9h3XDpWDBFluSNZ5NRjOxgWajSq4rAg
PT7MUia1GkRyhfMVnmGT85cbET3/CdFkzKH+tuV7+E6tJhlvcTYHHBkslGjGK8fX
KPX9BCxgOx+1HPpzTZnTNTxBsDkBurmW5JK4VG6H+Z3zJuXobnuNn90bItHVMz1t
B/isfHRLHo8WbgvdJ4GQxuByOmVHuMv7BqrJpus6Wuavph7m6VMFaKRwKKUtwzOm
JocjPrZ3nBh8GEmrLdhktUhtsRqLFOyjL6wNB/KRdZyy2lAK7/srn+o+x7DwHweh
9goCkSLkCoM/GDehg5hEIR4YWDsEvdGGeMaUCk2XHGvQ3kC1EfhZnIRcfyxtHAVe
cFwckbOjqim5oHW9h9Fg
=DSXv
-----END PGP SIGNATURE-----