URL: https://linuxfr.org/users/octane/journaux/faille-de-s%C3%A9curit%C3%A9-dans-grub
Title: faille de sécurité dans GRUB
Authors: octane
Date: 2009年12月14日T11:57:52+01:00
Tags: grub et cybersécurité
Score: 9
Bonjour, 
 
une petite faille de sécurité ''amusante'' 
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555195](http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=555195) 
 
GRUB accepts user input as valid password as long as user enters some first 
characters of password correctly. 
I.e. if /boot/grub/grub.cfg reads: 
set superusers="user1" 
password user1 password1 
Then user can enter "p", "pa", "pas" etc, and GRUB will 'eat it' as correct 
password. 
Considering that this 'feature' effectively lowers password length to 1 (one), 
I've set severity of this bug to 'important'. Feel free to add 'security' tag, 
if appropriate. 
 
--> Moi, je le flaggerai bien comme 'important' et comme 'security' tag! 
Donc, mettez vous à jour, un caractère comme force d'un mot de passe, c'est tout de même peu :-)
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="httpS://linuxfr.org/users/octane/journaux/faille-de-s%C3%A9curit%C3%A9-dans-grub.md">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="httpS://linuxfr.org/users/octane/journaux/faille-de-s%C3%A9curit%C3%A9-dans-grub.md" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>