A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious     or malfunctioning client can send less than the expected amount of data to the iperf server, which can     cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This     will prevent other connections to the server, leading to a denial of service. (CVE-2023-7250)

Note that Nessus relies on the presence of the package as reported by the vendor.

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4032 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4032-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 28, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : iperf3     Version        : 3.9-1+deb11u2     CVE ID         : CVE-2023-7250 CVE-2024-26306 CVE-2024-53580     Debian Bug     : 1071751 1090931

    Several security vulnerabilities have been discovered in iperf3, an internet     protocol bandwidth measuring tool, which may lead to a denial-of-service. When     iperf3 was used as a server with RSA authentication CVE-2024-26306 allowed a     timing side channel attack in RSA decryption operations sufficient for an     attacker to recover credential plaintext.

    For Debian 11 bullseye, these problems have been fixed in version     3.9-1+deb11u2.

    We recommend that you upgrade your iperf3 packages.

    For the detailed security status of iperf3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/iperf3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9185 advisory.

    [3.9-13]
    - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used

    [3.9-12]
    - Resolves: RHEL-39975 - possible denial of service

    [3.9-11]
    - Related: #2223676 - bumping version for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9185 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250,ESNET-SECADV-2023-0002)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the iperf package has been released.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-4241 advisory.

    [3.5-10]
    - Resolves: RHEL-29578 - vulnerable to marvin attack if the authentication option is used

    [3.5-9]
    - Resolves: RHEL-17069 - possible denial of service

    [3.5-8]
    - Related: #2222205 - bumping nvr for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:4241 advisory.

    * iperf3: possible denial of service (CVE-2023-7250)
    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4241 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-7250 advisory.

  - A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious     or malfunctioning client can send less than the expected amount of data to the iperf server, which can     cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This     will prevent other connections to the server, leading to a denial of service. (CVE-2023-7250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2579 advisory.

    It is possible for a malicious or malfunctioning client to send lessthan the expected amount of data to     the server. If this happens, theserver will hang indefinitely waiting for the remainder (or until     theconnection gets closed). Because iperf3 is deliberately designed toservice only one client connection     at a time, this will prevent otherconnections to the iperf3 server.Avoid running iperf3 with root     privileges to minimize impact.Update iperf3 to a version containing the fix (i.e. iperf-3.15 orlater).
    (CVE-2023-7250)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
228103	Linux Distros Unpatched Vulnerability : CVE-2023-7250	Nessus	Misc.	medium
502884	Siemens SCALANCE W700 Permissive List of Allowed Inputs (CVE-2023-7250)	Tenable OT Security	Tenable.ot	medium
214741	Debian dla-4032 : iperf3 - security update	Nessus	Debian Local Security Checks	medium
211568	Oracle Linux 9 : iperf3 (ELSA-2024-9185)	Nessus	Oracle Linux Local Security Checks	medium
210804	RHEL 9 : iperf3 (RHSA-2024:9185)	Nessus	Red Hat Local Security Checks	medium
204474	Photon OS 5.0: Iperf PHSA-2024-5.0-0272	Nessus	PhotonOS Local Security Checks	medium
201845	Oracle Linux 8 : iperf3 (ELSA-2024-4241)	Nessus	Oracle Linux Local Security Checks	medium
201540	AlmaLinux 8 : iperf3 (ALSA-2024:4241)	Nessus	Alma Linux Local Security Checks	medium
201282	RHEL 8 : iperf3 (RHSA-2024:4241)	Nessus	Red Hat Local Security Checks	medium
201271	CBL Mariner 2.0 Security Update: iperf3 (CVE-2023-7250)	Nessus	MarinerOS Local Security Checks	medium
200905	Amazon Linux 2 : iperf3 (ALAS-2024-2579)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-7250

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium