Auth bypass in GNU Grub 2
CVE-2009-4128
GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.
Vulnerability class: Broken Authentication
EPSS: 0.006 (43.9th percentile) — read the EPSS interpretation.
Affected products
- Gnu Grub_2 — versions 1.97
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit)
- cve@mitre.org (Patch, vdb-entry)
- cve@mitre.org (vdb-entry)
- cve@mitre.org (mailing-list)