Pavel Odintsov

**Name of the Vulnerable Software and Affected Versions** FastNetMon Community Edition versions prior to 1.3.0 **Description** An out-of-bounds read exists in the IPv4 packet parser within the file `src/simple packet parser ng.cpp`. After confirming a packet contains at least 20 bytes, the system advances the `local pointer` by `4 * ipv4 header->get ihl()` without verifying if the Internet Header Length (IHL) is at least 5 or if the required bytes are actually present. Because the IHL field allows values from 0 to 15, an IHL of 15 can lead to a 40-byte over-read. Conversely, an IHL between 0 and 4 prevents the pointer from advancing past the IP header, causing type confusion where TCP/UDP headers are parsed from IP header data. This issue is reachable through any packet capture interface. **Recommendations** Update FastNetMon Community Edition to version 1.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** FastNetMon Community Edition versions prior to 1.2.10 **Description** An integer overflow occurs during packet capture buffer allocation in the `allocate buffer()` function. The software calculates `memory size in bytes` using 32-bit unsigned integer arithmetic. When the `ban details records count` configuration parameter is set to a value exceeding approximately 2,832,542, the multiplication overflows, leading to a memory allocation that is smaller than required. Consequently, calls to the `write packet()` function write data beyond the allocated buffer, resulting in heap corruption. This issue stems from the use of `atoi()` to parse the configuration parameter without implementing overflow checks. **Recommendations** Update to version 1.2.10 or later. As a temporary mitigation, ensure the `ban details records count` configuration parameter is set to a value significantly below 2,832,542.