0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Skype On Debian Microsoft Apt Repo Addition Vulnerability
[Skype On Debian Microsoft Apt Repo Addition Vulnerability
Level: Critical
Description:
The Skype debian packege for Skype (even when not installed via their
offical repo) automatically installs apt configuration that adds
Microsoft's apt repo to the system's package sources.
That way, Microsoft (or anybody holding their repo's private key)
can easily inject malicious packages via regular update and replace
distro packages w/ their own manipulated ones.
Suggested vendor solution:
Remove all apt configuration stuff from the .deb.
Operator's workaround:
a) remove Skype's apt config (sources.list entry as well as the
Microsoft apt key) immediately after installation
b) unpack and repackage it manually (w/o that apt config) before
installation on production machines
c) use apt pinning to restrict the Microsoft repo to only the
package 'skypeforlinux'
c) only install it in a strictly confined container
--mtx
--
Enrico Weigelt, metux IT consult
# 0day.today [2024-11-14] #