| Description: | Summary:
The remote host is missing an update for the 'grub2'
package(s) announced via the referenced advisory.
Vulnerability Insight:
The grub2 packages provide version 2 of
the Grand Unified Bootloader (GRUB), a highly configurable and customizable
bootloader with modular architecture. The packages support a variety of kernel
formats, file systems, computer architectures, and hardware devices.
A flaw was found in the way the grub2 handled backspace characters entered
in username and password prompts. An attacker with access to the system
console could use this flaw to bypass grub2 password protection and gain
administrative access to the system. (CVE-2015-8370)
This update also fixes the following bug:
* When upgrading from Red Hat Enterprise Linux 7.1 and earlier, a
configured boot password was not correctly migrated to the newly introduced
user.cfg configuration files. This could possibly prevent system
administrators from changing grub2 configuration during system boot even if
they provided the correct password. This update corrects the password
migration script and the incorrectly generated user.cfg file. (BZ#1290089)
All grub2 users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.
Affected Software/OS:
grub2 on Red Hat Enterprise Linux Server (v. 7)
Solution:
Please Install the Updated Packages.
CVSS Score:
6.9
CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
