Re: Port scan causing system crashes

From: MARTIN M. Bénoni (benoni_martin_at_hotmail.com)
Date: 06/12/03

  • Next message: Whiteside, Larry [contractor]: "RE: Port scan causing system crashes" 
    To: steve.x.jones@royalmail.com, pen-test@securityfocus.com
Date: Thu, 12 Jun 2003 15:23:10 +0000

    Hi!

    Well, I have such problems last year as well, on old Sun boxes. The Sun were
    very loaded with many requests from clients, and the portscan we did made
    them crash down. However we were running Nmap with the option allowing us to
    initiate many connetions to many ports at the same time, and this has the
    same result than a port scan Dos.

    Maybe the heavy load the boxes were supporting, and our mutiple scans added
    to that made the box to fall down.

    >From: steve.x.jones@royalmail.com
    >To: pen-test@securityfocus.com
    >Subject: Port scan causing system crashes
    >Date: Thu, 12 Jun 2003 11:23:06 +0000
    >
    >
    >
    >Hello
    >
    >Please can you help? Has any-one else out there had issues with NMAP port
    >scans
    >(or any other port scanner) causing systems to crash?
    >
    >I use Nessus to baseline the security of our systems and have twice had
    >problems
    >caused by the NMAP port scan on clustered unix boxes running our enterprise
    >applications. NOTE - it was the initial port scan that caused the
    >problems, not
    >the subsequent vulnerability assessment.
    >I've done a quick Google search and found confirmation for one of the
    >systems -
    >BUGTRAQ Vulnerability 3358, "IBM HACMP Port Scan Denial of Service
    >Vulnerability",
    >the other was a bespoke app running on some HP UX boxes.
    >
    >Does any-one know of other systems that fall over with a simple port scan?
    >
    >Up til now I've been running port scans happily across our subnets to look
    >for
    >rogue FTP, SMTP, HTTP etc, obviously I'll have to take more care now...
    >
    >Thanks in advance for any help.
    >
    >Steve
    >
    >
    >
    >This email and any attachments are confidential and intended for the
    >addressee
    >only. If you are not the named recipient, you must not use, disclose,
    >reproduce,
    >copy or distribute the contents of this communication. If you have
    >received this
    >in error, please contact the sender and then delete this email from your
    >system.
    >
    >
    >
    >---------------------------------------------------------------------------
    >----------------------------------------------------------------------------
    >

    _________________________________________________________________
    Protect your PC - get McAfee.com VirusScan Online
    http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Whiteside, Larry [contractor]: "RE: Port scan causing system crashes"

    Relevant Pages

    • Re: [fw-wiz] FW: OT? New compromise.
      ... If you suspect you have a rootkit, it shouldn't be that hard to find it, ... depending on whether you can shut down any of these boxes and run Knoppix ... Port 1863 is the port for Microsoft's Instant Messenger client ...
      (Firewall-Wizards)
    • RE: Port scan causing system crashes
      ... In the thousand or so boxes I've scanned over the last year I've ... had three crash. ... Port scan causing system crashes ... port scans (or any other port scanner) causing systems to crash? ...
      (Pen-Test)
    • RE: [Full-Disclosure] Automated SSH login attempts?
      ... hopefully you don't have the test user on your ssh server anymore. ... You just gave the IP address, port and username =) ... One of the boxes at work actually got rooted through a successful ...
      (Full-Disclosure)
    • Re: rst-scan for portmap?
      ... >>Just the solitary RST packet, to both boxes, from the same source machine & ... >>port#, to my port 111. ... >>Combining port-scanning and OS fingerprinting, ...
      (comp.os.linux.security)
    • RE: Port scan causing system crashes
      ... DGUX 2.x and below definitely die upon port scan, ... Port scan causing system crashes ... > Denial of Service Vulnerability", the other was a bespoke app ...
      (Pen-Test)