CVE-2021-34902

Vulnerability

A remote attacker can exploit an out-of-bounds read vulnerability in Bentley View versions prior to 10.16.02.* [2]. The flaw exists in the parsing of DWG files, where user-supplied data is not properly validated, leading to a read past the end of an allocated object [1]. This affects both MicroStation and MicroStation-based applications, including Bentley View [2]. User interaction is required; the victim must open a malicious DWG file or visit a malicious page [1].

Exploitation

An attacker must craft a malicious DWG file that triggers the out-of-bounds read when parsed by an affected version of Bentley View or MicroStation [1][2]. The attacker then convinces the user to open the file (e.g., via email or web download). No authentication or elevated privileges are needed, as the vulnerability is triggered by normal file-open operations [1].

Impact

Successful exploitation results in disclosure of sensitive memory contents from the current process [1]. The CVSS score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) [1][2]. While the initial impact is information disclosure, an attacker could potentially leverage this vulnerability in combination with other bugs to achieve arbitrary code execution in the context of the current process [1][2].

Mitigation

Bentley has addressed these vulnerabilities in Bentley View version 10.16.02.* and later [2]. Users should update to the most recent version. As a general best practice, only open DWG files from trusted sources [2]. No workaround is available for unpatched versions.