CVE-2021-46618 : Security Advisory and Response

This CVE pertains to a vulnerability in Bentley's MicroStation CONNECT version 10.16.0.80, allowing remote attackers to disclose sensitive information. User interaction is required to exploit this flaw, which involves parsing PNG images and can lead to arbitrary code execution.

Understanding CVE-2021-46618

This section provides an overview of the vulnerability and its impact, along with technical details.

What is CVE-2021-46618?

CVE-2021-46618 is a security vulnerability in Bentley MicroStation CONNECT 10.16.0.80, enabling remote attackers to access sensitive data. The flaw arises from inadequate validation of user-supplied data during the parsing of PNG images.

The Impact of CVE-2021-46618

The vulnerability can have the following implications:

Attackers may disclose sensitive information on affected installations.
Successful exploitation can result in the execution of arbitrary code within the current process.

Technical Details of CVE-2021-46618

This section delves into the specifics of the vulnerability in terms of description, affected systems, and exploitation.

Vulnerability Description

The flaw allows attackers to read past the end of an allocated buffer, triggered by parsing PNG images without proper validation of user-supplied data.

Affected Systems and Versions

Affected Product: MicroStation CONNECT
Vendor: Bentley
Affected Version: 10.16.0.80

Exploitation Mechanism

User interaction is necessary for exploit, requiring the target to access a malicious page or file.
Attack complexity is low, with remote attackers being able to leverage this vulnerability.

Mitigation and Prevention

Practical steps to address and prevent the exploitation of CVE-2021-46618.

Immediate Steps to Take

Update Bentley MicroStation CONNECT to a patched version that addresses this vulnerability.
Avoid visiting untrusted or potentially malicious websites.
Be cautious when opening files from unknown or suspicious sources.

Long-Term Security Practices

Regularly update software and security patches to protect against known vulnerabilities.
Implement network segmentation to limit the impact of potential breaches.

Patching and Updates

Bentley has likely released a patch to mitigate this vulnerability. Ensure prompt installation of updates to secure the system.