Iperf3
CVE-2023-38403
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionNVD
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
AnalysisAI
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Affected products include: Es Iperf3, Debian Debian Linux, Fedoraproject Fedora, Netapp Ontap Select Deploy Administration Utility, Netapp Clustered Data Ontap. Version information: before 3.14.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.
The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to c
iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Rated hig
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channe
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high seve
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authenti
In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium seve
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today