Re: HACMP and port scans

["Alex Polli" <apolli () pucrs br>]

Yes, I've faced this. In fact, the tcp connect() function, when applied to
certain HACMP ports causes the system to shut down that node. However, if
you make a SYN scan it won't happen.

IBM has given us no workaround, so we deployed a firewall in front of the
cluster machine, dropping packets to the HACMP ports.

Another gift from IBM to you.


----- Original Message -----
From: "Eoin D. Fleming" <rtfm () eircom net>
To: <bugtraq () securityfocus com>
Sent: Monday, September 24, 2001 6:27 PM
Subject: HACMP and port scans


> It appears that IBM's HACMP 4.4 clustering software can be induced to fail
> simply by port scanning clustered machines, has anyone come accross this
> vulnerability and is there a workaround?
>
> Thanks,
> RT