CVE-2021-46653 : Security Advisory and Response

A vulnerability in Bentley View 10.15.0.75 allows remote attackers to execute arbitrary code, posing a high-risk threat.

Understanding CVE-2021-46653

This CVE involves a heap-based buffer overflow vulnerability in Bentley View 10.15.0.75, impacting the execution of arbitrary code remotely.

What is CVE-2021-46653?

The vulnerability in Bentley View 10.15.0.75 enables remote attackers to execute arbitrary code by exploiting a flaw in BMP image parsing, due to improper validation of user-supplied data.

The Impact of CVE-2021-46653

CVSS Base Score: 7.8 (High)
Attack Vector: Local
User Interaction: Required
Confidentiality, Integrity, Availability Impact: High

Technical Details of CVE-2021-46653

This section delves into specific technical aspects of the vulnerability.

Vulnerability Description

The flaw is a heap-based buffer overflow issue that allows attackers to execute code in the context of the current process by manipulating BMP image parsing.

Affected Systems and Versions

Product: View
Vendor: Bentley
Version: 10.15.0.75

Exploitation Mechanism

To exploit this vulnerability, user interaction is necessary; the target must either visit a malicious page or open a malicious file.

Mitigation and Prevention

Protective measures to mitigate the risks posed by CVE-2021-46653.

Immediate Steps to Take

Update Bentley View to a patched version immediately.
Avoid visiting suspicious or untrusted websites.
Exercise caution when opening files from unknown sources.

Long-Term Security Practices

Regularly update software and security patches.
Implement network segmentation to restrict access.
Conduct security awareness training to educate users on safe online practices.

Patching and Updates

To address the vulnerability, apply patches provided by Bentley promptly.