Bug#56821: Important security hole: mbr allows anyone to boot from a floppy.
Le 2000-02-02, Randolph Chung écrivait :
> I'm afriad this is not acceptable because of some setup scenarios. You
I would be /very/ interested if you could elaborate on this point.
> probably should file a bug against the mbr package to ask that F be disabled
> under A if --enable -F was specified on the command line.
Hum, to my reading of the mbr source code, this would defeat the
whole purpose of the 'A' mode, which consists in allowing boot
from disabled partitions.
I would also be most interested in learning why it is not possible
to fix this problem simply by displaying prominent warnings in
the installation procedure that the user must manually overwrite
the MBR, in addition to the normal BIOS and LILO setup, if he
wants to prevent boot from floppy disks by unauthorized users.
Thomas.
Reply to: