0

I'm installing service on the cloud machine and I was wondering on port vulnerabilities for my customers.

My service which lives on server A (often on a customer site) needs to access server B (lives in a cloud) through port 1234. On server B there's a service running on port 1234, but customer often wants to block access to it as non standard port. Server A doesn't have a service running on that port, but still needs to be able to communicate on it.

Is there a vulnerability of opening port, which is used to establish connection with another service? If you scan a machine A, the port would be open, but there's nothing running on it.

Typical solution would be enabling port 1234 between IP A and IP B, but in cloud, we can't guarantee the IP addresses.

  • 2
    My opinion: This is very difficult to answer as a port is only a mean of transfer of data between two systems. So it all depends if the services using that port are vulnerable or not. Also it seems that even closed ports may be vulnerable: The vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system. – HamZa May 12 '13 at 15:05
  • 1
    "if you scan machine A the port would be open but there's nothing running on it". I don't understand. If there is no service, the port will be closed. If machine A connects to a service running on machine B, it won't open any port on machine A. – void_in May 12 '13 at 15:49
  • I probably should have said that firewall for machine A needs to have port opened not the machine itself. – John May 12 '13 at 16:29
  • 5
    John, outbound and inbound are very different. The firewall for machine A doesn't need to allow any inbound traffic (except replies, which are usually handled automatically by most firewalls). Just open an outbound port from machine A. – Rory Alsop May 12 '13 at 16:54
3

An open port is not a security vulnerability in itself. It allows an attacker to connect and exploit any vulnerabilities in the process that's running.

The answer to your question depends on how sure you are in security of your service. Did you ask someone to look at the code? Does it run with limited privileges (not root?). What's the worst that can happen if someone can control this service from the Internet?

Given answers to these questions ("risks"), you need to balance them with benefits from setting it up as you describe and see what you and your customers are comfortable with.

-2

open ports are vulnerable if and only if the process associated with has some kind of vulnerability..suppose a application running on a computer listens to port 3333 which do nothing but prints the data it receives then keeping the port open do no harm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.