When using Erlang programs like ejabberd the Erlang port mapper daemon epmd is started and opens port 4369.
This port is accessible over the internet (only most recent ejabberd versions allow to configure that epmd should bind to localhost) by default.
The ejabberd documentation recommends blocking this port via packet filter rules and a comment in the Debian bug tracker calls this default behavior ‘a nightmare from a security point of view’.
What is the worst case scenario when ejabberd is running and port 4369 is not blocked?
Say – the firewall is mis-configured by accident or something like that.
What would be the most evil thing a Erlang-fluent attacker could do over this port?
Under what user/privileges runs the epmd under a linux distribution (e.g. Debian/Ubuntu)?
You might find out the source/destination addresses and port number pairs of active connections between BEAMs. This may lead into DoS attacks to the inter-BEAM connections.