For those who do not know Canonical this is a company established in the United Kingdom, founded and financed by Mark Shuttleworth of South African origin. The company is in charge of developing software for computers and markets services oriented to Ubuntu, and operating system Gnu / Linux and applications based on free software.
In the case of GRUB or Grand Unified BootloaderWe can say that it is used to start one or more operating systems for the same computer, it is what is known as a boot manager, totally open source.
Now, we will talk about the Zero-Day vulnerability in GRUB2. This was first found by Ismael Ripoll and Hector Marco, two developers from the University of Valencia in Spain. Basically it is the misuse of the delete key, when the boot configuration is implemented password security. It is the incorrect use of keyboard combinations, where pressing any key can bypass the password entry. This problem is localized in packages upstream and obviously they make the information stored in the computer very vulnerable.
In the case of Ubuntu, several versions present this vulnerability flaw, like many distributions that are based on it.
Among the affected versions of Ubuntu we have:
- Ubuntu 15.10
- Ubuntu 15.04
- Ubuntu LTS 14.04
- Ubuntu LTS 12.04
The problem can be corrected by updating the system in the versions of the following packages:
- Ubuntu 15.10: grub2-common a 2.02 ~ beta2-29ubuntu0.2
- Ubuntu 15.04: grub2-common a 2.02 ~ beta2-22ubuntu1.4
- Ubuntu 14.04 LTS: grub2-common a 2.02 ~ beta2-9ubuntu1.6
- Ubuntu 12.04 LTS: grub2-common a 1.99-21ubuntu3.19
After the update, it is necessary to restart the computer to make all the pertinent changes.
Remember that this vulnerability could be used to bypass the GRUB password, so it is recommended that you perform the update to keep yourself safe.
Unlike Windows and OS x where these errors are corrected in a matter of years [http://www.cnnexpansion.com/tecnologia/2015/02/12/microsoft-corrige-falla-critica-en-windows-15-anos -after], the vulnerabilities in GNU / Linux are fixed in a matter of minutes or hours (they fixed it when they discovered the vulnerability)
It seems that you have not even read your own link.
The vulnerability was there for 15 years, but was discovered 1 year ago.
In Linux there have also been hidden vulnerabilities for decades, even though the preaching ensured that vulnerabilities were discovered faster or immediately because the source was open.
As soon as the vulnerability was reported, Microsoft began to work on a solution that was slow to come out due to the complexity of a safe and effective solution and the tests, and there was no urgency as it was not known to attackers.
That something is fixed quickly only means that making the patch was not complicated or that no QA is applied when releasing any code changes, nothing more.
But canonical has not discovered anything ... .. It just affects their distros nothing else
What? How?
Please correct that title as it is a tremendous lie… a lie in the news fact and a lie in the content of the article…
A vulnerability has been discovered in GRUB, but Canonical has had nothing to do with it. This vulnerability affects any Linux-like distribution, not just Ubuntu.
Speaking of the background, such a vulnerability is not as dangerous, since using a password in GRUB is as secure as using a password in BIOS. If a user wants security, obviously they will have a user password and disk encryption (in case the attacker has access to the device).
This will not become more than an anecdote.
regards
It is not as simple as you want to believe.
Here they explain a little why the password is important in GRUB and that it does not resolve with user passwords or encrypting things.
https://blog.desdelinux.net/como-proteger-grub-con-una-contrasena-linux/
Definitely.
Whenever something happens in Linux, it is immediately devalued first and then forgotten.
PS: have they tightened censorship in desdelinux that the comments no longer appear when sending?
what?. You have read the entry that your quotes ... does not say anything about disk encryption or user password, it only explains what it is for and how the password is used in GRUB2 ... It also confirms that you must have access to the device to violate security of the team (there are many other more effective ways than through GRUB ...)
And no matter how much you access as administrator through GRUB, if you have the permissions of the partitions, user keys and LUKS encryption well established (among other things), they will not access your data (if they have access to your device of course).
Therefore, I still don't see the point. (Unless you only trust the GRUB password to secure your data).
With your new answer, you confirm that you do not see the meaning of the problem because you stay simple and cannot even imagine simple possibilities from that gap.
Of course I have read it, but I have also understood it.
Or maybe it is that I can realize the implications and scope of opening any gap.
A gap that should not be there, a gap in a security mechanism that was there because of something.
If you read the link you will find out that as this security login is skippable, it is possible to access the system as root, with which your super user password is nothing. And if you know something about what you are commenting on, I should not explain to you that when you log in as root it would be possible to look at or edit password hashes, edit users, modify the system to load or replace processes that monitor all user activity when it is authenticated. that could go from capturing their passwords to taking their decrypted data and sending all of that "home"; among thousands of other things that can happen to an attacker who has more knowledge than people like you who live in bubbles of complacency, false security and "they will never succeed if you have well established bla bla bla."
Just because you can't think of things doesn't mean that you can't do things.
Nor does it matter that there are many "more effective" methods, the problem is that now there is one more method, which should not be there because of a vulnerability.
And it is a highly accessible and easy method, rated by people who assess vulnerabilities.
You no longer need Livecds, USBs, unlock BIOS, open boxes, remove hard drives, put external drives, etc; just stand in front of the keyboard and press ONE key.
And do not worry, that tomorrow when the news is that your super LUKS today has a vulnerability, people like you will come out to say that "a real serious Scotsman" does not trust disk encryption but other things (like GRUB even) .
Of course …. often headline: "Canonical discovers vulnerability in GRUB2." And what a way to write the news. With this news in the end it will seem that Canonical / Ubuntu are the only ones that do things for free software. The package is maintained by colin watson for Debian, and incidentally has uploaded it to Ubuntu, as indicated in the package version. Nor is there any comment on how the vulnerability is triggered, which is by pressing the backspace key 28 times.
Greetings.
What is reprehensible to me is that it is commented, and by the way again and again, that the vulnerability is due to a "misuse of the keyboard." That sounds so: "they are holding the iPhone wrong."
No, the vulnerability is caused by bad programming, as always, period. It is inexcusable that pressing X times a key skips a security login.
What a headline, they will also say that while grub started a bug was discovered pressing the "e", also I tried in linux mint and nothing happens only in ubuntu.
PS: first they have to enter my house to use that vulnerability eye first uninstall mint and install ubuntu.
Your spelling leaves a lot to be desired
Local vulnerabilities are vulnerabilities after all.
In workstations, companies and other critical environments they will not be amused to have this vulnerability and more so using "secure linux". But I play well because they don't enter your house.
The e is also a risk that must be blocked. I don't know if you knew.
Hahaha Paco22, how do you defend this vulnerability ...
Believe me that in a serious company there are many security protocols to a) access the physical device b) to protect access to data.
And if your interest is still GRUB, it is easier to block it so as not to have access to it ...
@Hugo
It is not a question that a "true serious Scotsman" would use other security protocols, but that this is one of those protocols and IS FAILING, period. And incidentally, by failing it can compromise the rest, like the ones you mentioned swearing that they are the maximum guarantee.
This vulnerability does not need me to defend it, because it was discovered and qualified by specialists who do know about security and the devaluations of wannabes understand that they know a lot by using a distro is irrelevant.
I understand that it hurts them that little by little that myth of "secure linux" is being torn apart, even by pressing a single key.
Typical, they never change, always the same to minimize superlinux flaws.
man does not live on Ubuntu only