CVE-2012-2737
published 2012-07-22CVE-2012-2737: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying…
PriorityP410low1.9CVSS 2.0
AVLACMAuNCPINAN
EPSS
0.36%
28.6th percentile
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | accountsservice | >= 0 < 0.6.21-6 | 0.6.21-6 |
| canonical | accountsservice | >= 0 < 0.6.21-6 | 0.6.21-6 |
| canonical | accountsservice | >= 0 < 0.6.21-6 | 0.6.21-6 |
| canonical | accountsservice | >= 0 < 0.6.21-6 | 0.6.21-6 |
| debian | accountsservice | < accountsservice 0.6.21-6 (bookworm) | accountsservice 0.6.21-6 (bookworm) |
| ray_stode | accountsservice | <= 0.6.21 | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
| ray_stode | accountsservice | — | — |
CVSS provenance
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv1.9LOW
vendor_debian1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
AccountsService vulnerability
vendor_ubuntu·2012-06-28
CVE-2012-2737 AccountsService vulnerability
Title: AccountsService vulnerability
Summary: AccountsService could be made to read arbitrary files as the administrator.
Florian Weimer discovered that AccountsService incorrectly handled
privileges when copying certain files to the system cache directory. A
local attacker could exploit this issue to read arbitrary files, bypassing
intended permissions.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Debian
CVE-2012-2737: accountsservice - The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon...
vendor_debian·2012·CVSS 1.9
CVE-2012-2737 [LOW] CVE-2012-2737: accountsservice - The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon...
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Scope: local
bookworm: resolved (fixed in 0.6.21-6)
bullseye: resolved (fixed in 0.6.21-6)
forky: resolved (fixed in 0.6.21-6)
sid: resolved (fixed in 0.6.21-6)
trixie: resolved (fixed in 0.6.21-6)
GHSA
GHSA-26ch-x2j2-w6vx: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0
ghsa_unreviewed·2022-05-17
CVE-2012-2737 [LOW] CWE-362 GHSA-26ch-x2j2-w6vx: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
OSV
CVE-2012-2737: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0
osv·2012-07-22·CVSS 1.9
CVE-2012-2737 [LOW] CVE-2012-2737: The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2737 accountsservice: local file disclosure flaw [fedora-all]
bugzilla·2012-06-28·CVSS 1.9
CVE-2012-2737 [LOW] CVE-2012-2737 accountsservice: local file disclosure flaw [fedora-all]
CVE-2012-2737 accountsservice: local file disclosure flaw [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs
Bugzilla
CVE-2012-2737 accountsservice: local file disclosure flaw
bugzilla·2012-06-15·CVSS 1.9
CVE-2012-2737 [LOW] CVE-2012-2737 accountsservice: local file disclosure flaw
CVE-2012-2737 accountsservice: local file disclosure flaw
Florian Weimer found a local file disclosure flaw in accountsservice, an account management system using D-Bus for querying and manipulating user accounts. The implementation of the SetIconFile method of the org.freedesktop.Accounts.User D-Bus interface can disclose arbitrary files due to a race condition in user_change_icon_file_authorized_cb() in /usr/libexec/accounts-daemon. When this function calls get_caller_uid(), it uses PolicyKit to obtain the UID of the requesting process from /proc. At the time the UID is fetched, it may not match the original UID making the D-Bus request if the process has executed an SUID binary.
Discussion:
So this code got added here:
http://cgit.freedesktop.org/accountsservice/commit/?id=69b526a6c
http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543dhttp://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.htmlhttp://osvdb.org/83398http://secunia.com/advisories/49695http://secunia.com/advisories/49759http://www.openwall.com/lists/oss-security/2012/06/28/9http://www.securityfocus.com/bid/54223http://www.ubuntu.com/usn/USN-1485-1https://bugzilla.redhat.com/show_bug.cgi?id=832532https://exchange.xforce.ibmcloud.com/vulnerabilities/76648https://hermes.opensuse.org/messages/15100967http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543dhttp://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.htmlhttp://osvdb.org/83398http://secunia.com/advisories/49695http://secunia.com/advisories/49759http://www.openwall.com/lists/oss-security/2012/06/28/9http://www.securityfocus.com/bid/54223http://www.ubuntu.com/usn/USN-1485-1https://bugzilla.redhat.com/show_bug.cgi?id=832532https://exchange.xforce.ibmcloud.com/vulnerabilities/76648https://hermes.opensuse.org/messages/15100967
2012-07-22
Published