Possible Security Breach

From: rc <rc_at_spam.com>
Date: Thu, 26 Aug 2004 15:04:40 +0100
Message-ID: <p3rri01apc10a33sgr42i4d88gte5aqld6@4ax.com>

We run oracle 8.7.1.4 on Solaris 8 Sparc

I have noticed from our firewall log that our server is trying to connect to an IP address on the Internet on port 1521.

I have never allowed port 1521 in/out via the firewall

After further hunting, I have found that it is the pmon process that is initiating the syn packet. Obviously the pmon process is being told to do this something else.

Is there known holes in the version of Oracle we run or can any point in the direction to find out what is telling pmon to do this?

Thanks Received on Thu Aug 26 2004 - 09:04:40 CDT