[Yum-devel] Is YUM really a secure package manager ?

[James Antill]

On Tue, 2009-09-22 at 07:56 -0700, Akshay Wattal wrote:
> Hi,
> 
> i do agree on using signed repository metadata by YUM, but does it prevent the "freeze attack" in which the version of the packages can be compromised....for example showing  version 1.1 again and again even if newer version is present

 HTTPS metalink solves that problem, and also the same problems the
signed metadata solves (so current Fedora is fine even though they
aren't signing the repodata yet).

> Also what about Endless Data Attack....in which the mallicious party sender keeps sending data endlessly, in this case how can YUM terminate the connection.

 As soon as we get the metalink, we have byte size values for everything
(and use them to check the data). However atm. urlgrabber doesn't have
an interface to say "this download should be aborted if you get more
than X bytes". We will probably add that eventually.

-- 
James Antill <james at fedoraproject.org>
Fedora