[Yum-devel] Is YUM really a secure package manager ?

[Akshay Wattal]

Hi,

i do agree on using signed repository metadata by YUM, but does it prevent the "freeze attack" in which the version of the packages can be compromised....for example showing  version 1.1 again and again even if newer version is present


Also what about Endless Data Attack....in which the mallicious party sender keeps sending data endlessly, in this case how can YUM terminate the connection.

thanks  


      Get your preferred Email name!
Now you can @ymail.com and @rocketmail.com. 
http://mail.promotions.yahoo.com/newdomains/aa/