Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm installing service on the cloud machine and I was wondering on port vulnerabilities for my customers.

My service which lives on server A (often on a customer site) needs to access server B (lives in a cloud) through port 1234. On server B there's a service running on port 1234, but customer often wants to block access to it as non standard port. Server A doesn't have a service running on that port, but still needs to be able to communicate on it.

Is there a vulnerability of opening port, which is used to establish connection with another service? If you scan a machine A, the port would be open, but there's nothing running on it.

Typical solution would be enabling port 1234 between IP A and IP B, but in cloud, we can't guarantee the IP addresses.

share|improve this question
My opinion: This is very difficult to answer as a port is only a mean of transfer of data between two systems. So it all depends if the services using that port are vulnerable or not. Also it seems that even closed ports may be vulnerable: The vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system. – HamZa May 12 '13 at 15:05
"if you scan machine A the port would be open but there's nothing running on it". I don't understand. If there is no service, the port will be closed. If machine A connects to a service running on machine B, it won't open any port on machine A. – void_in May 12 '13 at 15:49
I probably should have said that firewall for machine A needs to have port opened not the machine itself. – John May 12 '13 at 16:29
John, outbound and inbound are very different. The firewall for machine A doesn't need to allow any inbound traffic (except replies, which are usually handled automatically by most firewalls). Just open an outbound port from machine A. – Rory Alsop May 12 '13 at 16:54

An open port is not a security vulnerability in itself. It allows an attacker to connect and exploit any vulnerabilities in the process that's running.

The answer to your question depends on how sure you are in security of your service. Did you ask someone to look at the code? Does it run with limited privileges (not root?). What's the worst that can happen if someone can control this service from the Internet?

Given answers to these questions ("risks"), you need to balance them with benefits from setting it up as you describe and see what you and your customers are comfortable with.

share|improve this answer

open ports are vulnerable if and only if the process associated with has some kind of vulnerability..suppose a application running on a computer listens to port 3333 which do nothing but prints the data it receives then keeping the port open do no harm

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.