en	[[!meta date="Sun, 07 Feb 2009 18:51:24 +0000"]]

en	[[!meta title="Possible use of an untrusted Live system found on local hard-disk"]]

en	[[!pagetemplate template="news.tmpl"]]

en	[[!tag security/fixed]]

en	live-initramfs boot scripts, that are used in amnesia, can boot an untrusted Live system found on the local hard-disk, rather than the one present on the USB stick on CD, as could be expected.

en	This can only happen in the (pretty rare) case when Linux needs more than 15 seconds to make the legitimate USB stick or CD ready.

en	Impact
es	Impacto

en	Booting another Live system than the one you think, without being told, can lead to any kind of information leak, anonymity break, etc.

en	Solution
es	Solución

en	None yet. Either build your own images from Git, or wait for the imminent 0.4.2 release.

en	Mitigation
es	Mitigación

en	Do not use amnesia on untrusted computers.
es	No uses amnesia en ordenadores no confiables.

en	Affected versions
es	Versiones afectadas

en	Any Debian Live-based system, including every amnesia release until, and including, 0.4.1.
es	Todos los sistemas basados en Debian Live, incluyendo todos los releases de amnesia hasta 0.4.1 inclusive.