CVE-2012-2737: Race Condition
First published: Fri Jun 15 2012(Updated: )
Florian Weimer found a local file disclosure flaw in accountsservice, an account management system using D-Bus for querying and manipulating user accounts. The implementation of the SetIconFile method of the org.freedesktop.Accounts.User D-Bus interface can disclose arbitrary files due to a race condition in user_change_icon_file_authorized_cb() in /usr/libexec/accounts-daemon. When this function calls get_caller_uid(), it uses PolicyKit to obtain the UID of the requesting process from /proc. At the time the UID is fetched, it may not match the original UID making the D-Bus request if the process has executed an SUID binary.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| accountsservice | <=0.6.21 | |
| accountsservice | =0.4 | |
| accountsservice | =0.5 | |
| accountsservice | =0.6 | |
| accountsservice | =0.6.1 | |
| accountsservice | =0.6.2 | |
| accountsservice | =0.6.3 | |
| accountsservice | =0.6.4 | |
| accountsservice | =0.6.5 | |
| accountsservice | =0.6.6 | |
| accountsservice | =0.6.7 | |
| accountsservice | =0.6.8 | |
| accountsservice | =0.6.9 | |
| accountsservice | =0.6.10 | |
| accountsservice | =0.6.11 | |
| accountsservice | =0.6.12 | |
| accountsservice | =0.6.13 | |
| accountsservice | =0.6.14 | |
| accountsservice | =0.6.15 | |
| accountsservice | =0.6.16 | |
| accountsservice | =0.6.17 | |
| accountsservice | =0.6.18 | |
| accountsservice | =0.6.19 | |
| accountsservice | =0.6.20 |
Remedy
http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5
Remedy
http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d
Remedy
http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cgit.freedesktop.org/accountsservice/commit/?id=69b526a6cd4c078732068de2ba393cf9242a404b
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=593003&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=593003&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=593044&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=593044&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=832532#c8
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=836284
- http://cgit.freedesktop.org/accountsservice/commit/?id=26213aa0e0d8dca5f36cc23f6942525224cbe9f5
- http://cgit.freedesktop.org/accountsservice/commit/?id=bd51aa4cdac380f55d607f4ffdf2ab3c00d08721
- http://cgit.freedesktop.org/accountsservice/commit/?id=4c5b12e363410e490e776e4b4a86dcce157a543d
- https://bugzilla.redhat.com/show_bug.cgi?id=832532
- http://cgit.freedesktop.org/accountsservice/commit/?id=27f3d93a82fde4f6c7ab54f3f008af04f93f9c69
- http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083359.html
- http://osvdb.org/83398
- http://secunia.com/advisories/49695
- http://secunia.com/advisories/49759
- http://www.openwall.com/lists/oss-security/2012/06/28/9
- http://www.securityfocus.com/bid/54223
- http://www.ubuntu.com/usn/USN-1485-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76648
- https://hermes.opensuse.org/messages/15100967
Frequently Asked Questions
What is the severity of CVE-2012-2737?
CVE-2012-2737 has a medium severity rating due to its local file disclosure vulnerability.
How do I fix CVE-2012-2737?
To fix CVE-2012-2737, users should upgrade to a patched version of accountsservice that addresses the file disclosure flaw.
Which versions of accountsservice are affected by CVE-2012-2737?
CVE-2012-2737 affects accountsservice versions up to 0.6.21 and includes various specific versions starting from 0.4.
Is CVE-2012-2737 a remote or local vulnerability?
CVE-2012-2737 is a local vulnerability that requires access to the affected system to exploit.
What can an attacker achieve by exploiting CVE-2012-2737?
An attacker exploiting CVE-2012-2737 can disclose arbitrary files from the affected system.
- collector/redhat-bugzilla
- alias/CVE-2012-2737
- agent/type
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/remedy
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/tags
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- vendor/ray stode
- canonical/accountsservice
- version/accountsservice/0.6.21
- version/accountsservice/0.4
- version/accountsservice/0.5
- version/accountsservice/0.6
- version/accountsservice/0.6.1
- version/accountsservice/0.6.2
- version/accountsservice/0.6.3
- version/accountsservice/0.6.4
- version/accountsservice/0.6.5
- version/accountsservice/0.6.6
- version/accountsservice/0.6.7
- version/accountsservice/0.6.8
- version/accountsservice/0.6.9
- version/accountsservice/0.6.10
- version/accountsservice/0.6.11
- version/accountsservice/0.6.12
- version/accountsservice/0.6.13
- version/accountsservice/0.6.14
- version/accountsservice/0.6.15
- version/accountsservice/0.6.16
- version/accountsservice/0.6.17
- version/accountsservice/0.6.18
- version/accountsservice/0.6.19
- version/accountsservice/0.6.20