CVE-2021-29096
📋 TL;DR
A use-after-free vulnerability in Esri ArcGIS products allows arbitrary code execution when parsing malicious files. Unauthenticated attackers can exploit this to run code with the current user's privileges. Affected products include ArcReader, ArcGIS Desktop, ArcGIS Engine, and ArcGIS Pro.
💻 Affected Systems
- ArcReader
- ArcGIS Desktop
- ArcGIS Engine
- ArcGIS Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Malicious file execution resulting in malware installation, credential theft, or unauthorized access to sensitive geospatial data.
If Mitigated
Limited impact through application sandboxing or restricted user privileges preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction to open malicious files but no authentication. Proof-of-concept details are not publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ArcGIS Desktop 10.8.2, ArcGIS Pro 2.8, and corresponding updates for other products
Vendor Advisory: https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
Restart Required: Yes
Instructions:
1. Download and install the latest security updates from Esri's official website. 2. Apply patches to all affected ArcGIS installations. 3. Restart systems after patching. 4. Verify successful installation through version checks.
🔧 Temporary Workarounds
Restrict file processing
windowsBlock processing of untrusted raster files through application controls or file type restrictions.
User privilege reduction
windowsRun ArcGIS applications with limited user privileges to contain potential exploitation.
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Deploy network segmentation to isolate ArcGIS systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check installed ArcGIS version against affected versions list. Review system logs for unexpected file processing events.Check Version:
In ArcGIS Desktop: Help → About ArcMap. In ArcGIS Pro: Project → About ArcGIS Pro.Verify Fix Applied:
Confirm version numbers match patched releases: ArcGIS Desktop ≥10.8.2, ArcGIS Pro ≥2.8, or later versions.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- Suspicious file processing events
- Unusual network connections from ArcGIS processes
Network Indicators:
- Outbound connections from ArcGIS to unknown IPs
- Unusual data exfiltration patterns
SIEM Query:
source="arcgis" AND (event_type="crash" OR file_extension IN ("*.tif", "*.img", "*.sid"))🔗 References
- https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
- https://www.zerodayinitiative.com/advisories/ZDI-21-370/
- https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
- https://www.zerodayinitiative.com/advisories/ZDI-21-370/
