CVE-2013-4577 A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the fi...
LowCVSS 2.1
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/grub2(Debian:12) | < 2.00-20 | 2.00-20 |
| debian/grub2(Debian:13) | < 2.00-20 | 2.00-20 |
| debian/grub2(Debian:14) | < 2.00-20 | 2.00-20 |
| GNU grub | All versions | No fix listed |
References
- Debian Security Tracker CVE-2013-4577 vendor-advisory
- [oss-security] 20131114 CVE Request: grub-mkconfig mailing-list patch
- [oss-security] 20131114 Re: CVE Request: grub-mkconfig mailing-list patch
- www.openwall.com
- bugs.debian.org
- bugs.debian.org issue-tracking