[Yum-devel] Is YUM really a secure package manager ?

[Seth Vidal]

On Tue, 22 Sep 2009, Seth Vidal wrote:

>
> Out of curiosity - how does firefox deal with this? Not all sites send a 
> content-length header. Especially ftp-based sites.
>
> I can see some fixes for it that wouldn't be too hard - I'm just not sure it 
> is a serious issue.
>
> It's a pretty convoluted way to DoS a system:
>
> 1. compromise a mirror of a url
> 2. modify the server to send an endless stream of data
> 3. wait for the client to fallover from memory or disk exhaustion.
>
> Having said that: The new version of urlgrabber is pycurl based - I'll put a 
> check into urlgrabber to bail out if the content-length is <  current size. 
> And we can set a max on it to some arbitrary number. so if the site doesn't 
> publish a content-length we can still bail.

endless data is now checked for in urlgrabber. I'll put support for it 
into yum soon. This will keep intentionally malicious servers from 
overrunning anything.

-sv