PT-2003-2508 · Oracle · Sun Cluster

Published 2003-12-31 · Updated 2018-10-30 · CVE-2003-1563

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:L/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sun Cluster versions 2.2 through 3.2 for Oracle Parallel Server / Real Application Clusters (OPS/RAC)

Description The issue allows local users to cause a denial of service, potentially leading to a cluster node panic or abort. This can be achieved by launching a daemon that listens on a TCP port that would otherwise be used by the Distributed Lock Manager (DLM). The daemon may respond in a manner that spoofs a cluster reconfiguration, triggering the denial of service.

Recommendations For Sun Cluster versions 2.2 through 3.2, consider restricting access to the TCP ports used by the Distributed Lock Manager (DLM) to prevent unauthorized daemons from listening on these ports. As a temporary workaround, consider disabling the DLM or restricting its functionality until a patch is available.

Fix

Related Identifiers

CVE-2003-1563

Affected Products

Sun Cluster

References · 5

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-200810-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101393-1 · Vendor Advisory
• http://auscert.org.au/render.html?it=3672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1563 · Security Note
• http://securityfocus.com/bid/9137 · Note