CVE-2021-46598 : Security Advisory and Response

This CVE-2021-46598 vulnerability affects Bentley MicroStation CONNECT version 10.16.0.80, allowing remote attackers to execute arbitrary code. User interaction is necessary through visiting malicious pages or opening malicious files.

Understanding CVE-2021-46598

What is CVE-2021-46598?

This vulnerability in Bentley MicroStation CONNECT 10.16.0.80 enables attackers to trigger memory corruption by exploiting flaws in the parsing of JT files, leading to arbitrary code execution.

The Impact of CVE-2021-46598

The impact of this vulnerability is rated as high severity in terms of confidentiality, integrity, and availability. With a CVSS base score of 7.8, its exploitation requires no special privileges but user interaction is essential.

Technical Details of CVE-2021-46598

Vulnerability Description

The flaw stems from improper validation of user-supplied data, allowing attackers to corrupt memory and execute code within the process context.

Affected Systems and Versions

Product: MicroStation CONNECT
Vendor: Bentley
Versions affected: 10.16.0.80

Exploitation Mechanism

To exploit this vulnerability, attackers need users to interact by accessing a malicious page or opening a malicious file.

Mitigation and Prevention

Immediate Steps to Take

Update MicroStation CONNECT to a patched version immediately.
Avoid visiting untrusted websites or opening suspicious files.

Long-Term Security Practices

Implement web filtering tools to block malicious websites.
Educate users on safe browsing habits and email security.

Patching and Updates

Apply security patches and updates provided by Bentley to fix this vulnerability.