Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today I found an article about a skype hotfix and noticed that the repo I use on my linux notebook:

deb stable non-free

Doesn't have the new version, but a very old one.

I'm running my current installation since about one month and I'm afraid I could have been infected. I noticed some crashes of the skype client and think that there could have been attacks on the vulnerabilities.

Does anybody know more about the skype repo and why the version isn't updated? Maybe I'm wrong and these versions aren't affected.

share|improve this question

closed as too localized by Jeff Ferland, Scott Pack, AviD Aug 18 '12 at 21:37

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Firstly, upvote cx42net's answer, because as he says, the vulnerability only affects a certain type of package - the statically linked one.

The difference between static and dynamic linking is the use of shared objects. In a statically linked program, all 3rd party code is "baked in". If there are any vulnerabilities in it, the whole lot needs updating to fix that library.

By contrast, dynamically linked programs use shared libs which can be updated independently (e.g. by your distribution) and thus fixes in third party libraries are handled by your distribution as soon as possible, and apply to all software run post update (because running applications will have the old SOs mapped into memory).

How do you tell which you have? The unix file command will tell you:

$ file /usr/bin/skype
ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

If you see that, you're okay. It is highly unlikely you're using the static version from a debian repository - that just wouldn't make sense from a distribution point of view (the whole point of using static linking is to get around incompatible shared libraries - whereas if you have a repository, you can set dependencies on compatible libraries and kernel versions and make the download smaller to boot).

noticed some crashes of the skype client and think that there could have been attacks on the vulnerabilities.

I'd be more inclined to put that down to the beta status of the software - although you're right to be cautious and investigating your system will not hurt.

share|improve this answer

This security update only affect the static package of Skype as indicated here, which means you are affected by this problem only if you donwloaded the last link in that page.

Since you use the Debian depot, it's not affected by this vulnerability, like said in the first link :

This security issue affects Skype 2.2 for Linux static package only. If you are using any other package of Skype 2.2 for Linux, then you are not affected by this issue.

Now, as the libpng page state :

All "modern" versions of libpng (...) fail to correctly handle malloc() failure for text chunks (in png_set_text_2()), which can lead to memory corruption and the possibility of execution of hostile code.

This is pretty serious. If you did run the static package, you should check if your computer has been compromised. It's not easy but you can find some verification point via Google, like :

Hope this helps!

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.