Fireworks legally sold at retail for consumer use (without any special license) in the U.S. can have as much as 500grams of blackpowder per unit. That is a little over 1 pound.
These are typical 500 gram "cakes" legally available if you know where and how to purchase;
This is what the unit looks like if you remove all the colorful wrapping;
This is the specific mortar tube set FNC is reporting the Boston Bombers purchased;
They have reported that they either purchased two (2) of these sets or two-hundred dollars ($200) worth of these fireworks (they can't keep the story straight).
DISCLAIMER: The "legal" status of these fireworks is a convoluted matter. In some retail locations it is only legal for out of state residents to purchase (yes, they will check ID). If you legally purchase out of state, they may not be legal to transport back to your home state. In some jurisdictions, it may be legal to possess but not to display (ignite) these fireworks. I only know this because of work with my local Fire Department regarding 4th of July safety. I am NOT advocating ANYBODY purchase or display these fireworks and I am in no way proclaiming them "legal" in any community anywhere.