Often, users will install additional package repositories to their Linux distributions to be able to follow "bleeding-edge" versions of software that hasn't been/will never be backported to their distribution version.
packageA provided by
repoA depends on
libssl. Originally, no problems found; the only possible vulnerabilities would have to be supplied directly by
However, if the owner of the repository packages
libssl and includes it in their own repository (I've seen similar things in the wild), my system
libssl will be replaced by their compiled version of OpenSSL.
With this said, how difficult is it to do this? Do package managers (e.g. apt, yum) provide any protection against this? For all the user knows, a malicious repository could package a rootkit in a package called
libssl which in fact doesn't provide any SSL support whatsoever. If I understand correctly, if this were to happen, the user would receive no indication that this was happening, and their machine would be compromised with a simple