New answers tagged updates
Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To prevent getting a fake repo, I would make sure to use HTTPS for my repos, and run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests (the only available measure against DNS spoofing I have seen so far) But if the repository ...
It really depends on your threat model. If you are hosting some Wikileaks-grade document, that might be a very real threat. If it's just a casual server on the Internet, you'll just want to update as often as possible way before worrying about this kind of attack.
Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...
To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use OpenPGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates ...
Top 50 recent answers are included