Moderate Security Update for iperf3: Denial of Service and Authentication Vulnerabilities
Summary
ALSA-2024:9185: Moderate: iperf3 security update. Affects iperf3 versions < 3.9-13.el9. Fixed in 3.9-13.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Iperf3 is a widely used tool designed to measure maximum TCP bandwidth and tune various parameters, including UDP characteristics. It provides valuable metrics such as bandwidth, delay jitter, and datagram loss, making it essential for network performance testing. However, recent vulnerabilities have been identified that could compromise its security, particularly when authentication options are utilized.
Vulnerability Detail
The vulnerabilities in iperf3 include a potential denial of service (CVE-2023-7250) and a susceptibility to a marvin attack when the authentication option is enabled (CVE-2024-26306). The denial of service vulnerability could allow an attacker to disrupt the service, while the marvin attack could exploit authentication weaknesses, leading to unauthorized access or manipulation of data.
How To Fix
Minimum fixed version
3.9-13.el9
This is the first release that contains the fix.
sudo dnf update iperf3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you cannot update iperf3 immediately, consider disabling the authentication option to mitigate the risk of the marvin attack. However, this may not be feasible in all environments, and updating is the preferred solution.
Conclusion
The vulnerabilities identified in iperf3 pose significant risks, including potential denial of service and authentication exploitation. It is crucial to update to the latest version to mitigate these risks effectively. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for iperf3 →
FAQ
Iperf3 is a tool used for measuring network performance, specifically TCP and UDP bandwidth, delay jitter, and datagram loss.
The main vulnerabilities include a potential denial of service and a vulnerability to a marvin attack when authentication is enabled.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider disabling the authentication option as a temporary workaround to reduce risk.
For more details, refer to the CVE pages for CVE-2023-7250 and CVE-2024-26306, as well as the AlmaLinux Release Notes.
Related vulnerabilities
Recent vulnerabilities recorded for iperf3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
