The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.

This update of accountservice fixed a flaw in user_change_icon_file_authorized_cb() that could be exploited by local attackers to read arbitrary files.

Updated accountsservice packages fix security vulnerability :

Florian Weimer discovered that AccountsService incorrectly handled privileges when copying certain files to the system cache directory. A local attacker could exploit this issue to read arbitrary files, bypassing intended permissions (CVE-2012-2737).

This updates accountsservice to correct a local file disclosure security flaw. CVE-2012-2737

This update also corrects and issue where spurios users show up in the login screen user list.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer discovered that AccountsService incorrectly handled privileges when copying certain files to the system cache directory. A local attacker could exploit this issue to read arbitrary files, bypassing intended permissions.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74672	openSUSE Security Update : accountsservice (openSUSE-SU-2012:0845-1)	Nessus	SuSE Local Security Checks	low
66074	Mandriva Linux Security Advisory : accountsservice (MDVSA-2013:060)	Nessus	Mandriva Local Security Checks	low
59826	Fedora 17 : accountsservice-0.6.21-2.fc17 (2012-10120)	Nessus	Fedora Local Security Checks	low
59784	Ubuntu 11.10 / 12.04 LTS : accountsservice vulnerability (USN-1485-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2012-2737

medium

Tenable Plugins

low

low

low

low