Secure testing team - Jun 2010 - Bug#584822: grub2: Command 'password' is still ignored in 'Squeeze' although provided.

Package: grub2
Version: 1.98
Severity: critical
Tags: security
Justification: causes serious data loss


See http://www.gnu.org/software/grub/manual/html_node/password.html
and http://grub.enbug.org/CommandList  (comparing GRUB Legacy with GRUB2)

''password'' is ignored on every location of the file grub.cfg, 
even in the last published version of ''Squeeze'' (from
2010-06-06).

Please repair this bug if you intend to change the status of
''Squeeze''
to ''stable''. Otherwise ''Squeeze'' will remain
unusable as everybody
may have access to the OS. 

-- System Information:
Debian Release: 5.0.4
  APT prefers stable
  APT policy: (500, ''stable'')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE at euro, LC_CTYPE=de_DE at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages grub2 depends on:
ii  debconf [debconf-2.0]         1.5.24     Debian configuration management sy
pn  grub-pc                       <none>     (no description available)

grub2 recommends no packages.

grub2 suggests no packages.