Wed 16 Mar 2016 04:50:50 PM UTC, original submission:
Tested version: GNU GRUB 2.02 beta 2-22+deb8u1 <
Machine architecture: Intel Core i5 - 4200Um 1.6GHz, 8GB RAM, HDD 500GB, multiboot system; Intel Pentium 2117U, 1.80GHz (dual core), 4GB RAM, 250GB, virtual machine emulated system.
Tested target systems: Kali Linux 2.0, Kali Linux 1.0 and Windows (10).
Priority: Severe (major)
Primary effect: bypassing login (changing password of a Linux's account)
Secondary effect: having access (as a privileged user) to all data/files/directories of the system
Main effect: having permission to modify/remove/add/execute anything you want in the system (that you wouldn't have access to it, without the password).
Date: 16/02/2016 15:32:11
Flaw view: When accessing GNU GRUB it's possible to see what systems you can boot. Pressing "e" you have access to the "advanced" settings of the boot option. In the "settings" you can edit the line "linux /boot/vmlinuz-4.0.0-kali1-amd64 root=UUID=f\cd578e80739f-42c8-b3ab-f4f6b602b776 ro initrd=/install/gtk/initrd.gz" to "linux /boot/vmlinuz-4.0.0-kali1-amd64 root=UUID=f\cd578e80739f-42c8-b3ab-f4f6b602b776 rw init=/bin/bash", by doing this, it will prompt you a bash screen (terminal) and then, you can change all system's settings (including user password, removing directories and even corrupting the system!
Solving Suggestion: attributing fixed low permissions to the bash when not logged in the system. It means: not having permission to view the data in directories and not changing system's settings (like the password).
|