Kind of weak

Kind of weak

Posted Jul 14, 2008 17:14 UTC (Mon) by JoeBuck (subscriber, #2330)
Parent article: Study: Attacks on package managers

The idea behind this attack is for a mirror to contain older, known-vulnerable packages, but still signed by the vendor because they were once current. One problem with it is that apt and yum won't downgrade a package that already exists; furthermore, with yum at least the mirror that you get is "randomly" selected. So only users who are installing a package for the first time, and that are unlucky enough to be assigned your mirror, are vulnerable, meaning that you're unlikely to be able to replace an essential package with a broken one in this way.

Mirrors could also be audited after security updates go out, to verify that they contain essential security updates and those that don't could be blackballed.

---

(Log in to post comments)

There is a 'yum-fastestmirror' plugin, so if you know the target computer is using it, you can
set up a mirror a small number of hops away and have a good chance of being preselected.
Signing and dating the package list is still the safest solution.