Mageia alert MGASA-2016-0235 (iperf)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0235: Updated iperf packages fix security vulnerability 
Date:
    	     
 
Tue, 5 Jul 2016 17:47:40 +0200
Message-ID:
    	     
 
<20160705154740.0A3C29F751@duvel.mageia.org>
MGASA-2016-0235 - Updated iperf packages fix security vulnerability

Publication date: 05 Jul 2016
URL: http://advisories.mageia.org/MGASA-2016-0235.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-4303

Description:
A malicious process can connect to an iperf server and, by sending a
malformed message on the control channel, corrupt the server process's
heap area.  This can lead to a crash (and a denial of service), or
theoretically a remote code execution as the user running the iperf
server.  A malicious iperf server could potentially mount a similar
attack on an iperf client (CVE-2016-4303).

References:
- https://bugs.mageia.org/show_bug.cgi?id=18743
-
https://raw.githubusercontent.com/esnet/security/master/c...
-
https://lists.fedoraproject.org/archives/list/package-ann...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4303

SRPMS:
- 5/core/iperf-3.0.12-1.mga5