IBM HACMP Port Scan Denial of Service Vulnerability

Bugtraq ID:	3358
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 24 2001 12:00AM
Updated:	Sep 24 2001 12:00AM
Credit:	This vulnerability was reported to Bugtraq by Eoin D. Fleming <[email protected]> on September 24, 2001.
Vulnerable:	IBM HACMP 4.4 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 5.1
Not Vulnerable:

IBM HACMP Port Scan Denial of Service Vulnerability

HACMP is a high availability cluster software package distributed and maintained by IBM.

A problem has been reported in the software package that could allow a denial of service to legitimate users of systems managed by the suite. Systems manages by HACMP that are portscanned via the TCP connect() function fail.

This could result in assets managed by the cluster becoming unreachable via the network, thus denying service to legitimate users of the systems.

IBM HACMP Port Scan Denial of Service Vulnerability

A portscanning utility is required to take advantage of this vulnerability.

IBM HACMP Port Scan Denial of Service Vulnerability

Solution:
A suggested workaround is to use the packet filter included with 4.3 series releases of AIX to block untrusted traffic on the HACMP ports.

Vendor fixes available:


IBM HACMP 4.4

• IBM IY17630
  http://techsupport.services.ibm.com/rs6000/fixes


• IBM IY20943
  http://techsupport.services.ibm.com/rs6000/fixes

IBM HACMP Port Scan Denial of Service Vulnerability

References: