iperf3: denial of service
| Package(s): | iperf3 | CVE #(s): | CVE-2016-4303 | ||||||||||||||||||||
| Created: | June 20, 2016 | Updated: | August 22, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A bug exists in the way that the included version of the cjson library handles Unicode literals in JSON string constants. A malformed Unicode literal can cause a process parsing a block of JSON to overwrite a pre-allocated buffer in the heap. Note that this bug has already been fixed in recent versions of cjson. A malicious process can connect to an iperf3 server and, by sending a malformed message on the control channel, corrupt the server process's heap area. This can lead to a crash (and a denial of service), or theoretically a remote code execution as the user running the iperf3 server. A malicious iperf3 server could potentially mount a similar attack on an iperf3 client. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||