CVE-2021-34935
📋 TL;DR
CVE-2021-34935 is a buffer overflow vulnerability in Bentley View's JT file parser that allows remote code execution. Attackers can exploit this by tricking users into opening malicious JT files, potentially compromising their systems. This affects users of Bentley View 10.15.0.75 who open untrusted JT files.
💻 Affected Systems
- Bentley View
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation leading to data exfiltration, credential theft, or system disruption for individual users who open malicious JT files.
If Mitigated
Limited impact with proper security controls - potentially isolated to the application process without system-wide compromise if sandboxed.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious JT file is opened. ZDI-CAN-14913 indicates professional vulnerability research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version 10.16.02 or later
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0005
Restart Required: Yes
Instructions:
1. Download latest Bentley View from official Bentley website. 2. Run installer. 3. Restart computer. 4. Verify version is 10.16.02 or higher.
🔧 Temporary Workarounds
Disable JT file association
windowsRemove Bentley View as default handler for .jt files to prevent automatic opening
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program > Change .jt to open with different application
Application sandboxing
allRun Bentley View in restricted environment to limit potential damage
🧯 If You Can't Patch
- Implement strict email filtering to block JT file attachments
- Use application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version: Open Bentley View > Help > About. If version is exactly 10.15.0.75, system is vulnerable.Check Version:
On Windows: wmic product where name="Bentley View" get versionVerify Fix Applied:
Verify version is 10.16.02 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Multiple crashes of Bentley View process
- Unusual file access patterns for .jt files
- Process spawning from Bentley View
Network Indicators:
- Outbound connections from Bentley View to unknown IPs
- Unusual DNS requests from system running Bentley View
SIEM Query:
Process:Name="Bentley View" AND (EventID=1000 OR EventID=1001) OR FileExtension=".jt" AND ProcessCreation