A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9185 advisory.

    [3.9-13]
    - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used

    [3.9-12]
    - Resolves: RHEL-39975 - possible denial of service

    [3.9-11]
    - Related: #2223676 - bumping version for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9185 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250,ESNET-SECADV-2023-0002)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the iperf package has been released.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-4241 advisory.

    [3.5-10]
    - Resolves: RHEL-29578 - vulnerable to marvin attack if the authentication option is used

    [3.5-9]
    - Resolves: RHEL-17069 - possible denial of service

    [3.5-8]
    - Related: #2222205 - bumping nvr for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:4241 advisory.

    * iperf3: possible denial of service (CVE-2023-7250)
    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4241 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7250 advisory.

  - A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious     or malfunctioning client can send less than the expected amount of data to the iperf server, which can     cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This     will prevent other connections to the server, leading to a denial of service. (CVE-2023-7250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2579 advisory.

    It is possible for a malicious or malfunctioning client to send lessthan the expected amount of data to     the server. If this happens, theserver will hang indefinitely waiting for the remainder (or until     theconnection gets closed). Because iperf3 is deliberately designed toservice only one client connection     at a time, this will prevent otherconnections to the iperf3 server.Avoid running iperf3 with root     privileges to minimize impact.Update iperf3 to a version containing the fix (i.e. iperf-3.15 orlater).
    (CVE-2023-7250)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - iperf3: possible denial of service (CVE-2023-7250)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Severity
211568	Oracle Linux 9 : iperf3 (ELSA-2024-9185)	Nessus	Oracle Linux Local Security Checks	medium
210804	RHEL 9 : iperf3 (RHSA-2024:9185)	Nessus	Red Hat Local Security Checks	medium
204474	Photon OS 5.0: Iperf PHSA-2024-5.0-0272	Nessus	PhotonOS Local Security Checks	medium
201845	Oracle Linux 8 : iperf3 (ELSA-2024-4241)	Nessus	Oracle Linux Local Security Checks	medium
201540	AlmaLinux 8 : iperf3 (ALSA-2024:4241)	Nessus	Alma Linux Local Security Checks	medium
201282	RHEL 8 : iperf3 (RHSA-2024:4241)	Nessus	Red Hat Local Security Checks	medium
201271	CBL Mariner 2.0 Security Update: iperf3 (CVE-2023-7250)	Nessus	MarinerOS Local Security Checks	medium
200905	Amazon Linux 2 : iperf3 (ALAS-2024-2579)	Nessus	Amazon Linux Local Security Checks	medium
199762	RHEL 9 : iperf3 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2023-7250

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium