iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9185 advisory.

    [3.9-13]
    - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used

    [3.9-12]
    - Resolves: RHEL-39975 - possible denial of service

    [3.9-11]
    - Related: #2223676 - bumping version for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9185 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250,ESNET-SECADV-2023-0002)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26306 advisory.

  - iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a     timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to     recover credential plaintext. It requires the attacker to send a large number of messages for decryption,     as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario. (CVE-2024-26306)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-4241 advisory.

    [3.5-10]
    - Resolves: RHEL-29578 - vulnerable to marvin attack if the authentication option is used

    [3.5-9]
    - Resolves: RHEL-17069 - possible denial of service

    [3.5-8]
    - Related: #2222205 - bumping nvr for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:4241 advisory.

    * iperf3: possible denial of service (CVE-2023-7250)
    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4241 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1981-1 advisory.

    - Update to version 3.17.1
    - CVE-2024-26306: Fixed a vulnerability that could led to marvin attack if the authentication option is     used. (bsc#1224262)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211568	Oracle Linux 9 : iperf3 (ELSA-2024-9185)	Nessus	Oracle Linux Local Security Checks	medium
502666	Siemens SCALANCE M-800 Observable Discrepancy (CVE-2024-26306)	Tenable OT Security	Tenable.ot	medium
210804	RHEL 9 : iperf3 (RHSA-2024:9185)	Nessus	Red Hat Local Security Checks	medium
205678	CBL Mariner 2.0 Security Update: iperf3 (CVE-2024-26306)	Nessus	MarinerOS Local Security Checks	medium
201845	Oracle Linux 8 : iperf3 (ELSA-2024-4241)	Nessus	Oracle Linux Local Security Checks	medium
201540	AlmaLinux 8 : iperf3 (ALSA-2024:4241)	Nessus	Alma Linux Local Security Checks	medium
201282	RHEL 8 : iperf3 (RHSA-2024:4241)	Nessus	Red Hat Local Security Checks	medium
200408	SUSE SLES15 / openSUSE 15 Security Update : iperf (SUSE-SU-2024:1981-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-26306

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium