Bug 864544 (CVE-2013-4577) - VUL-0: CVE-2013-4577: grub2: grub-cfg with hashed passwords public readable
Summary: VUL-0: CVE-2013-4577: grub2: grub-cfg with hashed passwords public readable
Status: RESOLVED FIXED
Alias: CVE-2013-4577
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Michael Chang
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/96268/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-19 08:24 UTC by Victor Pereira
Modified: 2014-03-06 04:35 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-02-19 08:24:01 UTC 
CVE-2013-4577

grub-mkconfig on Debian and derivatives sets mode 444 on grub.cfg 
configuration files if there are no plaintext passwords in the 
configuration file. However, the permissions are still set world
readable if the password_pbkdf2 directive includes a hashed
password.

References:
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-4577.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4577
Comment 1 Swamp Workflow Management 2014-02-19 23:00:12 UTC 
bugbot adjusting priority
Comment 2 Michael Chang 2014-03-03 08:45:08 UTC 
I'm going to set the permission to 440 if there's plain password grepped in the grub.cfg.

As Josef implemented the password feature for SLE12 and also yast created this password file, I think we should also check with it.

Hi Josef,

Could you please help to check the file permission is not global readable if contains plain text password. (And if you uses hashed password should be fine leaving it ..).

Thanks.
Comment 3 Josef Reidinger 2014-03-03 08:47:50 UTC 
Michael - I set password file permissions to 0755 as it is executable, but as it is run only by root, then maybe 0700 is good enough. Affected line is:

https://github.com/yast/yast-bootloader/blob/master/src/lib/bootloader/grub2pwd.rb#L25
Comment 4 Michael Chang 2014-03-03 09:01:54 UTC 
Hi Josef,

Thanks for feedback. Yes I agree with you.
Comment 5 Josef Reidinger 2014-03-03 10:11:35 UTC 
fix send as https://github.com/yast/yast-bootloader/pull/46 ( only related to permissions for 42_password file )
Comment 6 Michael Chang 2014-03-06 04:35:44 UTC 
The CVE is for fixing Debain's own patch that we doesn't apply. I checked with upstream's permission settings on SLE12 and is actually more stricter.

$ ls -l /boot/grub2/grub.cfg
-rw------- 1 root root 6204 Mar 6 11:51 /boot/grub2/grub.cfg

So close this issue as Josef has checked the implementation wouldn't have similar issue.

Thanks. :)