PT-2026-45842 · Debian+2 · Fastnetmon
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FastNetMon Community Edition versions prior to 1.3.0
Description
An out-of-bounds read exists in the IPv4 packet parser within the file
src/simple packet parser ng.cpp. After confirming a packet contains at least 20 bytes, the system advances the local pointer by 4 * ipv4 header->get ihl() without verifying if the Internet Header Length (IHL) is at least 5 or if the required bytes are actually present. Because the IHL field allows values from 0 to 15, an IHL of 15 can lead to a 40-byte over-read. Conversely, an IHL between 0 and 4 prevents the pointer from advancing past the IP header, causing type confusion where TCP/UDP headers are parsed from IP header data. This issue is reachable through any packet capture interface.Recommendations
Update FastNetMon Community Edition to version 1.3.0 or later.
Exploit
Fix
Type Confusion
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fastnetmon