Re: Remote DoS attack in Real Networks Real Server (Strike #2) vulnerability

[ryan () SECURITYFOCUS COM (Ryan Russell)]

I believe I have a temporary workaround.

In the rmserver.cfg file, there's a section like this:

<!-- H T T P S U P P O R T --> <List Name="HTTPDeliverable">
    <Var Path_0="/admin"/>
    <Var Path_1="/ramgen"/>
    <Var Path_2="/farm"/>
    <Var Path_3="/httpfs"/>
    <Var Path_4="/viewsource"/>
</List>

On my Real server, I've removed this line:
<Var Path_4="/viewsource"/>

I *think* this only has the consequence that people can't pull down file
details for audio content for the moment.  We can still serve up audio
just fine.

                                Ryan