The version of iperf3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26306 advisory.

  - iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a     timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to     recover credential plaintext. It requires the attacker to send a large number of messages for decryption,     as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario. (CVE-2024-26306)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-9185 advisory.

    [3.9-13]
    - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used

    [3.9-12]
    - Resolves: RHEL-39975 - possible denial of service

    [3.9-11]
    - Related: #2223676 - bumping version for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1981-1 advisory.

    - Update to version 3.17.1
    - CVE-2024-26306: Fixed a vulnerability that could led to marvin attack if the authentication option is     used. (bsc#1224262)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9185 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250,ESNET-SECADV-2023-0002)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0254 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-7250:
    A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious     or malfunctioning client can send less than the expected amount of data to the iperf server, which can     cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This     will prevent other connections to the server, leading to a denial of service.

    CVE-2024-26306:
    iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a     timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to     recover credential plaintext. It requires the attacker to send a large number of messages for decryption,     as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4241 advisory.

    * iperf3: possible denial of service (CVE-2023-7250)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iperf3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26306 advisory.

  - iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a     timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to     recover credential plaintext. It requires the attacker to send a large number of messages for decryption,     as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario. (CVE-2024-26306)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-4241 advisory.

    [3.5-10]
    - Resolves: RHEL-29578 - vulnerable to marvin attack if the authentication option is used

    [3.5-9]
    - Resolves: RHEL-17069 - possible denial of service

    [3.5-8]
    - Related: #2222205 - bumping nvr for correct update path

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a     timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to     recover credential plaintext. It requires the attacker to send a large number of messages for decryption,     as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario. (CVE-2024-26306)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4241 advisory.

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP     characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

    Security Fix(es):

    * iperf3: possible denial of service (CVE-2023-7250)

    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:4241 advisory.

    * iperf3: possible denial of service (CVE-2023-7250)
    * iperf3: vulnerable to marvin attack if the authentication option is used (CVE-2024-26306)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4032 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4032-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 28, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : iperf3     Version        : 3.9-1+deb11u2     CVE ID         : CVE-2023-7250 CVE-2024-26306 CVE-2024-53580     Debian Bug     : 1071751 1090931

    Several security vulnerabilities have been discovered in iperf3, an internet     protocol bandwidth measuring tool, which may lead to a denial-of-service. When     iperf3 was used as a server with RSA authentication CVE-2024-26306 allowed a     timing side channel attack in RSA decryption operations sufficient for an     attacker to recover credential plaintext.

    For Debian 11 bullseye, these problems have been fixed in version     3.9-1+deb11u2.

    We recommend that you upgrade your iperf3 packages.

    For the detailed security status of iperf3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/iperf3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the iperf package has been released.

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
205678	CBL Mariner 2.0 Security Update: iperf3 (CVE-2024-26306)	Nessus	MarinerOS Local Security Checks	8/16/2024	2/12/2025	medium
211568	Oracle Linux 9 : iperf3 (ELSA-2024-9185)	Nessus	Oracle Linux Local Security Checks	11/19/2024	2/11/2025	medium
200408	SUSE SLES15 / openSUSE 15 Security Update : iperf (SUSE-SU-2024:1981-1)	Nessus	SuSE Local Security Checks	6/12/2024	6/12/2024	medium
210804	RHEL 9 : iperf3 (RHSA-2024:9185)	Nessus	Red Hat Local Security Checks	11/12/2024	2/11/2025	medium
235989	Alibaba Cloud Linux 3 : 0254: iperf3 (ALINUX3-SA-2024:0254)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
235573	RockyLinux 8 : iperf3 (RLSA-2024:4241)	Nessus	Rocky Linux Local Security Checks	5/7/2025	5/7/2025	medium
215370	Azure Linux 3.0 Security Update: iperf3 (CVE-2024-26306)	Nessus	Azure Linux Local Security Checks	2/10/2025	2/10/2025	medium
201845	Oracle Linux 8 : iperf3 (ELSA-2024-4241)	Nessus	Oracle Linux Local Security Checks	7/3/2024	2/11/2025	medium
227846	Linux Distros Unpatched Vulnerability : CVE-2024-26306	Nessus	Misc.	3/5/2025	3/5/2025	medium
201282	RHEL 8 : iperf3 (RHSA-2024:4241)	Nessus	Red Hat Local Security Checks	7/2/2024	2/11/2025	medium
201540	AlmaLinux 8 : iperf3 (ALSA-2024:4241)	Nessus	Alma Linux Local Security Checks	7/3/2024	2/11/2025	medium
214741	Debian dla-4032 : iperf3 - security update	Nessus	Debian Local Security Checks	1/28/2025	2/11/2025	medium
236994	Photon OS 4.0: Iperf PHSA-2025-4.0-0803	Nessus	PhotonOS Local Security Checks	5/21/2025	5/21/2025	medium
502666	Siemens SCALANCE M-800 Observable Discrepancy (CVE-2024-26306)	Tenable OT Security	Tenable.ot	11/18/2024	11/26/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium