Software Engineering Institute

It has been reported that Kindle Touch 5.1.0 has introduced a NPAPI plugin /usr/lib/libkindleplugin.so (symlinked to /usrl/lib/browser/plugins/libkindleplugin.so) that can be used by the system-wide WebKit engine. libkindleplugin is scriptable by the browser and can be invoked to access its "exported" native methods when a user accesses a web page containing embedded scripts.

The user eureka has reported on the MobileRead forums that they have found multiple "exported" properties and methods associated with libkindleplugin.

• property test (it just returns number 500)
• method dev.log
• method lipc.set
• method lipc.get
• method todo.scheduleItems
• plugin.test
• plugin.lipc.test
• plugin.dev.test
• plugin.todo.test

By convincing a user to access a specially crafted web page, a remote, unauthenticated attacker may be able to execute arbitrary code with root privileges.

Update
It has been reported that Kindle Touch 5.1.2 deletes the NPAPI plugin /usr/lib/libkindleplugin.so, symlink /usrl/lib/browser/plugins/libkindleplugin.so and directory /usr/lib/browser. Users are advised to upgrade to Kindle Touch 5.1.2.

Disable libkindleplugin

Users are advised to disable libkindleplugin by renaming or removing the /usr/lib/browser/plugins/libkindleplugin.so symlink.