CVE-2021-29097 – Multiple buffer overflow vulnerabilities in Esr... (How to Fix)

Q: What is the severity of CVE-2021-29097?

CVE-2021-29097 has a CVSS score of 7.8 (HIGH). Multiple buffer overflow vulnerabilities in Esri's ArcGIS products allow arbitrary code execution when parsing malicious files. Unauthenticated attackers can exploit these flaws to run code with the privileges of the current user. Affected products include ArcReader, ArcGIS Desktop, ArcGIS Engine, and ArcGIS Pro.

📋 TL;DR

Multiple buffer overflow vulnerabilities in Esri's ArcGIS products allow arbitrary code execution when parsing malicious files. Unauthenticated attackers can exploit these flaws to run code with the privileges of the current user. Affected products include ArcReader, ArcGIS Desktop, ArcGIS Engine, and ArcGIS Pro.

💻 Affected Systems

Products:

ArcReader
ArcGIS Desktop
ArcGIS Engine
ArcGIS Pro

Versions: ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 and earlier; ArcGIS Pro 2.7 and earlier

Operating Systems: Windows, Linux, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: All installations within affected version ranges are vulnerable when processing raster files.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise leading to data theft, lateral movement, and persistent backdoor installation.

🟠

Likely Case

Local privilege escalation or malware execution on individual workstations.

🟢

If Mitigated

Limited impact if systems are patched, use least privilege, and restrict file processing.

🌐 Internet-Facing: MEDIUM - Exploitation requires file upload/processing, but web services using affected components could be vulnerable.

🏢 Internal Only: HIGH - Internal users could be tricked into opening malicious files, leading to widespread compromise.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires user interaction to open malicious files, but no authentication is needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: ArcGIS Desktop 10.8.2, ArcGIS Engine 10.8.2, ArcGIS Pro 2.8

Vendor Advisory: https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/

Restart Required: Yes

Instructions:

1. Download patches from Esri's website. 2. Apply patches to all affected systems. 3. Restart systems after installation. 4. Verify patch installation.

🔧 Temporary Workarounds

Restrict file processing

all

Block processing of untrusted raster files through application controls or group policy.

Use least privilege

all

Run ArcGIS applications with non-administrative accounts to limit exploit impact.

🧯 If You Can't Patch

Isolate affected systems from critical networks and internet access.
Implement application whitelisting to prevent execution of unauthorized code.

🔍 How to Verify

Check if Vulnerable:

Check installed version against affected ranges in ArcGIS About dialog.

Check Version:

In ArcGIS: Help > About ArcGIS [Product]

Verify Fix Applied:

Confirm version is 10.8.2 or higher for Desktop/Engine, or 2.8 or higher for Pro.

📡 Detection & Monitoring

Log Indicators:

Unexpected process crashes
Suspicious file parsing errors
Unusual child process creation from ArcGIS executables

Network Indicators:

Outbound connections from ArcGIS processes to unknown IPs
Unexpected file downloads to ArcGIS systems

SIEM Query:

Process creation where parent_process_name contains 'ArcGIS' and (process_name contains 'cmd.exe' or process_name contains 'powershell.exe')

📊 Metadata

CVE ID: CVE-2021-29097

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-121

Published: March 25, 2021

Last Updated: November 21, 2024

🔗 References

https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/ Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-360/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-363/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-364/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-365/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-367/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-368/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-369/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-371/ Third Party Advisory,VDB Entry
https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/ Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-360/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-363/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-364/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-365/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-367/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-368/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-369/ Third Party Advisory,VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-21-371/ Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-29097, you might also want to check these: