CVE-2021-46623 : Security Advisory and Response

This CVE-2021-46623 article provides detailed information about a vulnerability in Bentley View 10.15.0.75 identified by Mat Powell of Trend Micro Zero Day Initiative.

Understanding CVE-2021-46623

CVE-2021-46623 is a vulnerability that allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75.

What is CVE-2021-46623?

The vulnerability in Bentley View 10.15.0.75 allows remote attackers to obtain sensitive information by exploiting a flaw in parsing 3DS files.

The Impact of CVE-2021-46623

Attackers can execute arbitrary code in the context of the current process by leveraging this vulnerability.

Technical Details of CVE-2021-46623

Vulnerability Description

The vulnerability stems from the lack of proper validation of user-supplied data, leading to a read past the end of an allocated buffer.

Affected Systems and Versions

Affected Product: Bentley View
Affected Version: 10.15.0.75

Exploitation Mechanism

User interaction is required; the target must visit a malicious page or open a malicious file.

Mitigation and Prevention

Immediate Steps to Take

Update Bentley View to a non-vulnerable version.
Be cautious while visiting unknown websites or opening files.

Long-Term Security Practices

Regularly update software to patch known vulnerabilities.
Implement network security measures to detect and prevent attacks.

Patching and Updates

Follow vendor recommendations for applying security patches promptly.