Some weaknesses and a security issues have been reported in Calibre, which can be exploited by malicious, local users to manipulate certain data and gain escalated privileges.

1) An error within the "calibre-mount-helper" utility can be exploited to create arbitrary root-owned directories.

2) An error within the "calibre-mount-helper" utility can be exploited to delete arbitrary empty directories.

3) An error within the "calibre-mount-helper" utility can be exploited to create and delete the ".created_by_calibre_mount_helper" file in arbitrary directories.

4) The "calibre-mount-helper" utility does not use the full path when invoking other programs, which can be exploited to execute arbitrary applications as root by changing the "PATH" environment variable.

5) The "calibre-mount-helper" utility can be used to mount, unmount, and eject arbitrary directories and mountpoints.

6) Race conditions within the mount process can be exploited to e.g. mount arbitrary directories via symlink attacks.

Note: Additionally, it's possible to inject arguments to the "mount" utility.

Solution
Restrict access to trusted users only or remove the suid bit from the "calibre-mount-helper" utility.

Provided and/or discovered by
Jason A. Donenfeld. Additional information provided by Dan Rosenberg.

Original Advisory
https://bugs.launchpad.net/calibre/+bug/885027/

Deep Links
Links available in Customer Area