Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What can someone do if i write a program to open a TCP port and run, lets say an echo server? Can some one access data on my system? or any other risk of opening port?

share|improve this question

migrated from stackoverflow.com May 16 '12 at 8:56

This question came from our site for professional and enthusiast programmers.

    
This seems like a reasonable basic question, and I was a bit appalled to see it down voted and at -1 when there 9 up votes on the answer. If you find the answer useful, maybe don't kick the asker in the shins? –  Glenn Jun 30 '12 at 21:49

2 Answers 2

up vote 9 down vote accepted

It depends on how well the program is written and under what credentials your server program runs as. For instance say you allocate a fixed-length buffer to read from the socket, and then you read in more than the allocated size, it might be possible to craft a server requests that overruns the buffer on the stack and overwrites the return address. At that point the hacker could re-point the return address to be on the (overrun) buffer, which could contain actual code. Then, if your server program runs as root/administrator you're letting the code being executed in that context.

share|improve this answer
    
Note, while this is actually possible it's also getting more unlikely as OSes/Apps use the NX bit, and measures are taken to avoid buffer overflow problems. Also, most Linux distros have known priv elevation exploits, so even a user process might lead to rooting. –  Chris S May 16 '12 at 12:39

If your program is vulnerable, a hacker could possibly execute code on your system with privileges of your program. Or perhaps he could arrange a DoS attack (your program would consume all CPU or memory or disk space and everything would stop working and collapse :-) ).

In the past one also could find a bug in the OS TCP/IP stack and exploit it. So even if your program was perfect, there was a chance of getting into troubles with an open port. However I haven't heard of such bugs for a while now.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.