Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 12.04 LTS: USN-1485-1 Critical: AccountsService Access Issue

ubuntu
Calendar Grey June 28, 2012
Scroller Ubuntu
=========================================================================Ubuntu Security Notice USN-
AccountsService could be made to read arbitrary files as the administrator.

Summary

AccountsService could be made to read arbitrary files as the administrator.

Software Description:

- accountsservice: query and manipulate user account information

Details:

Florian Weimer discovered that AccountsService incorrectly handled

privileges when copying certain files to the system cache directory. A

local attacker could exploit this issue to read arbitrary files, bypassing

intended permissions.

Topics%20covered

Topics Covered

security advisory privilege escalation local attack ubuntu accountsservice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  accountsservice                 0.6.15-2ubuntu9.1
  libaccountsservice0             0.6.15-2ubuntu9.1

Ubuntu 11.10:
  accountsservice                 0.6.14-1git1ubuntu1.2
  libaccountsservice0             0.6.14-1git1ubuntu1.2

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1485-1

CVE-2012-2737

Severity
critical
Lowest
Low
Medium
High
Critical

June 28, 2012

Topics%20covered

Topics Covered

security advisory privilege escalation local attack ubuntu accountsservice

Package Information

https://launchpad.net/ubuntu/+source/accountsservice/0.6.15-2ubuntu9.1
https://launchpad.net/ubuntu/+source/accountsservice/0.6.14-1git1ubuntu1.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.