Buffer overflow in iperf - CVE-2024-53580

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU101836

Buffer overflow in iperf - CVE-2024-53580

Published: December 18, 2024


Vulnerability identifier: #VU101836
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-53580
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when handling JSON type data. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

iperf
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
Submariner
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
iperf3-devel
iperf3
iperf3 (Red Hat package)
iperf3 (Ubuntu package)
iperf3-help
iperf3-doc
iperf3-debugsource
iperf3-debuginfo
iperf
libiperf0
iperf-devel
iperf-debugsource
iperf-debuginfo
libiperf0-debuginfo
PowerScale OneFS

How to mitigate CVE-2024-53580

Install updates from vendor's website.

iperf - update to 3.18
Submariner - addressed in versions 0.16.8, 0.17.5, 0.18.5, 0.19.2
iperf3-devel - addressed in versions 3.1.7-3, 3.18-1
iperf3 - addressed in versions 3.1.7-3, 3.9-13, 3.18-1
iperf3 (Red Hat package) - addressed in versions 3.1.7-3.el7_9.1, 3.5-4.el8_2.1, 3.5-7.el8_4.1, 3.5-7.el8_6.1, 3.5-7.el8_8.1, 3.5-11.el8_10, 3.9-10.el9_0.1, 3.9-10.el9_2.1, 3.9-11.el9_4.1, 3.9-13.el9_5.1
iperf3 (Ubuntu package) - addressed in versions 3.7-3ubuntu0.1~esm2, 3.9-1+deb11u1ubuntu0.1, 3.16-1ubuntu0.1~esm1, 3.18-2ubuntu0.1
iperf3-help - update to 3.18-1
iperf3-devel - update to 3.18-1
iperf3-doc - update to 3.18-1
iperf3-debugsource - update to 3.18-1
iperf3-debuginfo - update to 3.18-1
iperf3 - update to 3.18-1
iperf - update to 3.18-150000.3.12.1
libiperf0 - update to 3.18-150000.3.12.1
iperf-devel - update to 3.18-150000.3.12.1
iperf-debugsource - update to 3.18-150000.3.12.1
iperf-debuginfo - update to 3.18-150000.3.12.1
libiperf0-debuginfo - update to 3.18-150000.3.12.1
PowerScale OneFS - addressed in versions 9.5.1.3, 9.7.1.8, 9.10.1.2

External References

Related Security Bulletins