usb-creator-helper allows any user to umount any filesystem

[Evan Broder]

Binary package hint: usb-creator-common

/usr/share/usb-creator/usb-creator-helper exposes a method called UnmountFile over D-Bus which passes its argument directly to umount.

This lets any user unmount an arbitrary filesystem by running something like:

dbus-send --system --type=method_call --print-reply --dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.UnmountFile string:/boot

[Kees Cook (kees)]

CVE-2011-1828

[Kees Cook (kees)]

It looks like the com.ubuntu.USBCreator.UnmountFile method is not polkit-wrapped. The others look to be checked, so that's good.

[Evan (ev)]

Lets try this again...

[Launchpad Janitor (janitor)]

This bug was fixed in the package usb-creator - 0.2.28.3

---------------
usb-creator (0.2.28.3) natty-security; urgency=low

  [ Marc Deslauriers ]
  * SECURITY UPDATE: unprivileged disk operations (LP: #771553)
    - CVE-2011-1828
  * setup.cfg: Specify policykit policy file as xml_file so it gets
    translated properly instead of being malformed.

  [ Evan Dandrea ]
  * Guard UnmountFile with PolicyKit (LP: #771553).
 -- Marc Deslauriers <email address hidden> Fri, 29 Apr 2011 13:06:10 -0400

[Mario Limonciello (superm1)]

This has a negative side effect that in the process of writing a USB disk you are now asked several times to enter a password. Can this be cached?