CVE-2021-46643

Vulnerability

A stack-based buffer overflow exists in Bentley View version 10.15.0.75 and earlier versions prior to 10.16.02.* (as noted in [2]) during the parsing of DGN files. The flaw arises because the program fails to properly validate the length of user-supplied data before copying it into a stack-based buffer [1]. This occurs in the context of opening a malicious DGN file, and the code path is reachable through file open or page visit without any special preconditions [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted DGN file or visit a malicious page [1]. No authentication or special network position is required. The attack is local (AV:L) as the user must perform the file open action. The attacker crafts a DGN file with oversized data in a field that triggers the buffer copy without length checking, leading to controlled stack corruption [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code within the context of the current user process [1]. This results in full compromise of confidentiality, integrity, and availability (CIA) of the affected system (CVSS 7.8, High) [1][2]. The attacker gains the same privileges as the user running Bentley View.

Mitigation

Bentley has released a fix in version 10.16.02.* of Bentley View and MicroStation, as noted in the advisory BE-2021-0009 [2]. Users should update to the latest version. As a workaround, only open DGN files from trusted sources [2]. This CVE is not listed on the known exploited vulnerabilities (KEV) catalog as of the publication date.