Description
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | accountsservice | 0.6.21-6 | — |
| Debian 13 | accountsservice | 0.6.21-6 | — |
| Debian 12 | accountsservice | 0.6.21-6 | — |
References
- 54223 vdb-entry
- http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721
- 49695 third-party-advisory
- USN-1485-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=832532
- 49759 third-party-advisory
- 83398 vdb-entry
- accountsservice-userchangeicon-info-disc(76648) vdb-entry
- openSUSE-SU-2012:0845 vendor-advisory
- http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5
- http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69
- [oss-security] 20120628 accountsservice local file disclosure flaw (CVE-2012-2737) mailing-list
- FEDORA-2012-10120 vendor-advisory
- http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d