ByteOS Network

Vulnerability Details :

CVE-2015-8370

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-16 Dec, 2015 | 00:00

Updated At-21 Oct, 2024 | 16:51

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:16 Dec, 2015 | 00:00

Updated At:21 Oct, 2024 | 16:51

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html	vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html	vendor-advisory
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html	N/A
http://www.securityfocus.com/bid/79358	vdb-entry
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html	vendor-advisory
http://www.securitytracker.com/id/1034422	vdb-entry
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html	vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html	vendor-advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	N/A
http://www.openwall.com/lists/oss-security/2015/12/15/6	mailing-list
http://www.securityfocus.com/archive/1/537115/100/0/threaded	mailing-list
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html	vendor-advisory
http://seclists.org/fulldisclosure/2015/Dec/69	mailing-list
https://security.gentoo.org/glsa/201512-03	vendor-advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html	vendor-advisory
http://www.ubuntu.com/usn/USN-2836-1	vendor-advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html	vendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2623.html	vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html	vendor-advisory
http://www.debian.org/security/2015/dsa-3421	vendor-advisory
http://www.openwall.com/lists/oss-security/2024/01/15/3	mailing-list

Hyperlink: http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html

Resource:

vendor-advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html

Resource:

vendor-advisory

Hyperlink: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/79358

Resource:

vdb-entry

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html

Resource:

vendor-advisory

Hyperlink: http://www.securitytracker.com/id/1034422

Resource:

vdb-entry

Hyperlink: http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html

Resource:

vendor-advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html

Resource:

vendor-advisory

Hyperlink: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2015/12/15/6

Resource:

mailing-list

Hyperlink: http://www.securityfocus.com/archive/1/537115/100/0/threaded

Resource:

mailing-list

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html

Resource:

vendor-advisory

Hyperlink: http://seclists.org/fulldisclosure/2015/Dec/69

Resource:

mailing-list

Hyperlink: https://security.gentoo.org/glsa/201512-03

Resource:

vendor-advisory

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html

Resource:

vendor-advisory

Hyperlink: http://www.ubuntu.com/usn/USN-2836-1

Resource:

vendor-advisory

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html

Resource:

vendor-advisory

Hyperlink: http://rhn.redhat.com/errata/RHSA-2015-2623.html

Resource:

vendor-advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html

Resource:

vendor-advisory

Hyperlink: http://www.debian.org/security/2015/dsa-3421

Resource:

vendor-advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2024/01/15/3

Resource:

mailing-list

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html	x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html	vendor-advisory x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html	vendor-advisory x_transferred
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html	x_transferred
http://www.securityfocus.com/bid/79358	vdb-entry x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html	vendor-advisory x_transferred
http://www.securitytracker.com/id/1034422	vdb-entry x_transferred
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html	vendor-advisory x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html	vendor-advisory x_transferred
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	x_transferred
http://www.openwall.com/lists/oss-security/2015/12/15/6	mailing-list x_transferred
http://www.securityfocus.com/archive/1/537115/100/0/threaded	mailing-list x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html	vendor-advisory x_transferred
http://seclists.org/fulldisclosure/2015/Dec/69	mailing-list x_transferred
https://security.gentoo.org/glsa/201512-03	vendor-advisory x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html	vendor-advisory x_transferred
http://www.ubuntu.com/usn/USN-2836-1	vendor-advisory x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html	vendor-advisory x_transferred
http://rhn.redhat.com/errata/RHSA-2015-2623.html	vendor-advisory x_transferred
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html	vendor-advisory x_transferred
http://www.debian.org/security/2015/dsa-3421	vendor-advisory x_transferred
http://www.openwall.com/lists/oss-security/2024/01/15/3	mailing-list x_transferred

Hyperlink: http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html

Resource:

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

Resource:

x_transferred

Hyperlink: http://www.securityfocus.com/bid/79358

Resource:

vdb-entry

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://www.securitytracker.com/id/1034422

Resource:

vdb-entry

x_transferred

Hyperlink: http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Resource:

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Resource:

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2015/12/15/6

Resource:

mailing-list

x_transferred

Hyperlink: http://www.securityfocus.com/archive/1/537115/100/0/threaded

Resource:

mailing-list

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2015/Dec/69

Resource:

mailing-list

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201512-03

Resource:

vendor-advisory

x_transferred

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://www.ubuntu.com/usn/USN-2836-1

Resource:

vendor-advisory

x_transferred

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://rhn.redhat.com/errata/RHSA-2015-2623.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html

Resource:

vendor-advisory

x_transferred

Hyperlink: http://www.debian.org/security/2015/dsa-3421

Resource:

vendor-advisory

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2024/01/15/3

Resource:

mailing-list

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-191	CWE-191 Integer Underflow (Wrap or Wraparound)

Type: CWE

CWE ID: CWE-191

Description: CWE-191 Integer Underflow (Wrap or Wraparound)

Metrics

Version	Base score	Base severity	Vector
3.1	7.4	HIGH	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:16 Dec, 2015 | 21:59

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.4	HIGH	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C

Type: Secondary

Version: 3.1

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.9

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-264	Primary	nvd@nist.gov
CWE-191	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-264

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-191

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html	cve@mitre.org	Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html	cve@mitre.org	N/A
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html	cve@mitre.org	N/A
http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html	cve@mitre.org	N/A
http://rhn.redhat.com/errata/RHSA-2015-2623.html	cve@mitre.org	N/A
http://seclists.org/fulldisclosure/2015/Dec/69	cve@mitre.org	N/A
http://www.debian.org/security/2015/dsa-3421	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2015/12/15/6	cve@mitre.org	N/A
http://www.openwall.com/lists/oss-security/2024/01/15/3	cve@mitre.org	N/A
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	cve@mitre.org	Patch
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	cve@mitre.org	N/A
http://www.securityfocus.com/archive/1/537115/100/0/threaded	cve@mitre.org	N/A
http://www.securityfocus.com/bid/79358	cve@mitre.org	N/A
http://www.securitytracker.com/id/1034422	cve@mitre.org	N/A
http://www.ubuntu.com/usn/USN-2836-1	cve@mitre.org	N/A
https://security.gentoo.org/glsa/201512-03	cve@mitre.org	N/A
http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://rhn.redhat.com/errata/RHSA-2015-2623.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://seclists.org/fulldisclosure/2015/Dec/69	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.debian.org/security/2015/dsa-3421	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.openwall.com/lists/oss-security/2015/12/15/6	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.openwall.com/lists/oss-security/2024/01/15/3	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	af854a3a-2127-422b-91ae-364da2661108	Patch
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/archive/1/537115/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/79358	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id/1034422	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.ubuntu.com/usn/USN-2836-1	af854a3a-2127-422b-91ae-364da2661108	N/A
https://security.gentoo.org/glsa/201512-03	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173703.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174049.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00037.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00039.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00040.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00041.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00043.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00044.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00003.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://rhn.redhat.com/errata/RHSA-2015-2623.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://seclists.org/fulldisclosure/2015/Dec/69

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.debian.org/security/2015/dsa-3421

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2015/12/15/6

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2024/01/15/3

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: cve@mitre.org

Resource:

Patch

Hyperlink: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/archive/1/537115/100/0/threaded

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/79358

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1034422

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.ubuntu.com/usn/USN-2836-1

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://security.gentoo.org/glsa/201512-03

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html