CyberRota Analysis
AI-GeneratedThe vulnerability affects the AccountsService helper scripts in Ubuntu, where user-controlled LANGUAGE entries in the ~/.pam_environment file are treated as trusted input. This flaw allows an attacker to inject arbitrary shell commands via a crafted LANGUAGE value, executing them with root privileges through the SetLanguage D-Bus method. System administrators and security teams managing Ubuntu environments should prioritize this issue to mitigate potential exploitation risks.
Original NVD Description
The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.