Executive brief
FastNetMon Community Edition, a DDoS detection tool, contains a flaw in how it allocates memory for storing packet captures. If an administrator sets an excessively high value for the packet record count in the configuration file, the software miscalculates the required memory, leading to a much smaller allocation than needed. This results in a memory corruption (heap overflow) when the software attempts to write packet data, potentially allowing an attacker with configuration access to crash the service or execute malicious code.
Technical details
An integer overflow exists in `src/packet_storage.hpp` within the `allocate_buffer()` function. The software calculates `memory_size_in_bytes` using 32-bit unsigned integer arithmetic based on the `ban_details_records_count` configuration parameter. When this parameter exceeds approximately 2,832,542, the multiplication wraps around, resulting in an undersized heap allocation via `malloc()`. Subsequent calls to `write_packet()` perform `memcpy` operations into this undersized buffer without sufficient bounds checking, causing a heap-based buffer overflow. An attacker with the ability to modify the `fastnetmon.conf` file can exploit this to achieve arbitrary code execution or cause a denial-of-service. As of the advisory date, no official patch has been released.
Affected products
- FastNetMon LTD FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: other: Vendor notified by Lorikeet Security
- 2026-05-23: advisory: Public disclosure by Lorikeet Security
- 2026-05-26: disclosed: CVE published to NVD