Bug was reported upstream here https://bugs.launchpad.net/calibre/+bug/885027 Calibre comes with a setuid root app called calibre-mount-helper. Unfortunately this app allows easily to execute any other binary with root permissions, as well as mounting anything anywhere, thus providing several ways to gain full root permissions. At the same time Calibre offers a plugin system that allows outsiders to gain the users trust and execute code easily. If upstream does not remove this setuid root binary altogether, it would be nice if Gentoo ebuild would exclude this file, or make it optional with a use flag. The calibre-mount-helper is supposed to mount USB storage (ereaders) and thus enable calibre to sync the ebook library onto it. As there are other ways to mount USB storage, or sync, or even save files to disks, this functionality is entirely optional and the program works fine without this file. Alternatively the calibre-mount-helper could be replaced with a shell script that uses another mounting facility (apparently Debian does that). Reproducible: Always
I've removed the existing ebuilds from the tree, and added a calibre-0.8.24-r1 ebuild that replaces the suid calibre-mount-helper with debian's udisks shell script wrapper: http://bazaar.launchpad.net/~calibre-packagers/calibre/debian/view/head:/debian/local/calibre-mount-helper
(In reply to comment #1) > I've removed the existing ebuilds from the tree, and added a calibre-0.8.24-r1 > ebuild that replaces the suid calibre-mount-helper with debian's udisks shell > script wrapper: > > http://bazaar.launchpad.net/~calibre-packagers/calibre/debian/view/head:/debian/local/calibre-mount-helper Great, thank you. Closing noglsa for ~arch only package.
CVE-2011-4124, CVE-2011-4125, CVE-2011-4126
