National Cyber Awareness System

Vulnerability Summary for CVE-2012-2737

Overview

The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721

Type: Patch Information; Exploit

Hyperlink:http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721

External Source: CONFIRM

Name: http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d

Type: Patch Information; Exploit

Hyperlink:http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d

External Source: CONFIRM

Name: http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5

Type: Patch Information; Exploit

Hyperlink:http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5

External Source: SUSE

Name: openSUSE-SU-2012:0845

Hyperlink:https://hermes.opensuse.org/messages/15100967

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=832532

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=832532

External Source: XF

Name: accountsservice-userchangeicon-info-disc(76648)

Hyperlink:http://xforce.iss.net/xforce/xfdb/76648

External Source: UBUNTU

Name: USN-1485-1

Hyperlink:http://www.ubuntu.com/usn/USN-1485-1

External Source: BID

Name: 54223

Hyperlink:http://www.securityfocus.com/bid/54223

External Source: MLIST

Name: [oss-security] 20120628 accountsservice local file disclosure flaw (CVE-2012-2737)

Hyperlink:http://www.openwall.com/lists/oss-security/2012/06/28/9

External Source: SECUNIA

Name: 49759

Type: Advisory

Hyperlink:http://secunia.com/advisories/49759

External Source: SECUNIA

Name: 49695

Type: Advisory

Hyperlink:http://secunia.com/advisories/49695

External Source: OSVDB

Name: 83398

Hyperlink:http://osvdb.org/83398

External Source: FEDORA

Name: FEDORA-2012-10120

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.html

External Source: CONFIRM

Name: http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69

Hyperlink:http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69