How likely is an infection with an outdated skype on linux? [closed]

Question

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:

deb http://download.skype.com/linux/repos/debian/ stable non-free

Doesn't have the new version, but a very old one.

I'm running my current installation since about one month and I'm afraid I could have been infected. I noticed some crashes of the skype client and think that there could have been attacks on the vulnerabilities.

Does anybody know more about the skype repo and why the version isn't updated? Maybe I'm wrong and these versions aren't affected.

Answer 1

This security update only affect the static package of Skype as indicated here, which means you are affected by this problem only if you donwloaded the last link in that page.

Since you use the Debian depot, it's not affected by this vulnerability, like said in the first link :

This security issue affects Skype 2.2 for Linux static package only. If you are using any other package of Skype 2.2 for Linux, then you are not affected by this issue.

Now, as the libpng page state :

All "modern" versions of libpng (...) fail to correctly handle malloc() failure for text chunks (in png_set_text_2()), which can lead to memory corruption and the possibility of execution of hostile code.

This is pretty serious. If you did run the static package, you should check if your computer has been compromised. It's not easy but you can find some verification point via Google, like :

• Few signs that your Linux server has been hacked
• How to know when you've been hacked
• Steps to investigate hacked linux server
• How To Identify The Bad Processes On A Hacked Linux Box

Hope this helps!

Answer 2

Firstly, upvote cx42net's answer, because as he says, the vulnerability only affects a certain type of package - the statically linked one.

The difference between static and dynamic linking is the use of shared objects. In a statically linked program, all 3rd party code is "baked in". If there are any vulnerabilities in it, the whole lot needs updating to fix that library.

By contrast, dynamically linked programs use shared libs which can be updated independently (e.g. by your distribution) and thus fixes in third party libraries are handled by your distribution as soon as possible, and apply to all software run post update (because running applications will have the old SOs mapped into memory).

How do you tell which you have? The unix file command will tell you:

$ file /usr/bin/skype
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

If you see that, you're okay. It is highly unlikely you're using the static version from a debian repository - that just wouldn't make sense from a distribution point of view (the whole point of using static linking is to get around incompatible shared libraries - whereas if you have a repository, you can set dependencies on compatible libraries and kernel versions and make the download smaller to boot).

noticed some crashes of the skype client and think that there could have been attacks on the vulnerabilities.

I'd be more inclined to put that down to the beta status of the software - although you're right to be cautious and investigating your system will not hurt.