Re: HACMP and port scans

From: Andrew Leonard (andy@geospiza.com)
Date: 09/25/01 

To: bugtraq@securityfocus.com
Subject: Re: HACMP and port scans
Message-ID: <1001441303.3bb0c817d5ca2@webmail.geospiza.com>
Date: Tue, 25 Sep 2001 11:08:23 -0700 (PDT)
From: Andrew Leonard <andy@geospiza.com>

Quoting "Eoin D. Fleming" <rtfm@eircom.net>:

> It appears that IBM's HACMP 4.4 clustering software can be induced to
> fail simply by port scanning clustered machines, has anyone come accross
> this vulnerability and is there a workaround?

I have not seen this particular vulnerability, having never used HACMP.
However, I did see a very similar thing on Compaq's TruCluster product two jobs
ago: If port-scanned from a machine without a PTR record in DNS, the cluster
would develop split-brain syndrome. At management's request, this was kept
quiet (as in, not posted here), and we worked with Compaq to develop a patch.

This was back in 1999, and applied to TruCluster 1.5 (I think...). I never saw
an advisory about this from Compaq, so as far as I know this was quietly rolled
into TruCluster updates.

cheers:
andy 

--
Andrew Leonard
Geospiza, Inc.
3939 Leary Way NW
Seattle, WA 98107
(206) 633-4403; (206) 633-4415 (fax)

Relevant Pages

  • Re: Failover in seconds
    ... > doesn't address the underlying problem that the server to which requests ... > where VMS Clusters, with their Connection Manager and cluster-wide file ... I should point out that IBM has had a clustering product for some ... Originally known as HACMP/6000, later renamed to HACMP. ...
    (comp.os.vms)
  • Re: HACMP and port scans
    ... Subject: HACMP and port scans ... > It appears that IBM's HACMP 4.4 clustering software can be induced to fail ... HACMP cluster servers to crash, ...
    (Bugtraq)
  • Re: opinions on aix clustering
    ... AIX's clustering is called HACMP - High Availability Cluster Multi ...
    (comp.unix.aix)
  • regatta environment terms, nodes, hacmp, frames
    ... this hacmp, clustering as well. ... to make my learning more challenging, i am exposed to other terms like ... nodes, and frames.. ...
    (comp.unix.aix)
  • HACMP and port scans
    ... It appears that IBM's HACMP 4.4 clustering software can be induced to fail ... simply by port scanning clustered machines, ...
    (Bugtraq)