CVE-2021-46631
📋 TL;DR
CVE-2021-46631 is a memory initialization vulnerability in Bentley View's TIF image parser that allows remote code execution when users open malicious TIF files or visit malicious web pages. This affects Bentley View 10.15.0.75 users who process untrusted TIF images. Attackers can execute arbitrary code with the privileges of the current user.
💻 Affected Systems
- Bentley View
📦 What is this software?
View by Bentley
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Malware installation or data exfiltration when users open malicious TIF files from untrusted sources.
If Mitigated
Limited impact if proper application hardening, least privilege, and network segmentation are implemented.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability is in memory initialization during TIF parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Bentley View version after 10.15.0.75
Vendor Advisory: https://www.bentley.com/en/common-vulnerability-exposure/BE-2021-0015
Restart Required: Yes
Instructions:
1. Download latest Bentley View version from Bentley's official website. 2. Run installer with administrative privileges. 3. Restart system after installation completes.
🔧 Temporary Workarounds
Disable TIF file association
windowsRemove Bentley View as default handler for .tif files to prevent automatic exploitation
Control Panel > Default Programs > Set Default Programs > Select Bentley View > Choose defaults for this program > Uncheck .tif/.tiff
Application control policy
windowsBlock execution of Bentley View from untrusted locations using AppLocker or similar
🧯 If You Can't Patch
- Implement strict email filtering to block TIF attachments from untrusted sources
- Run Bentley View with least privilege (non-admin account) to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check Bentley View version in Help > About. If version is 10.15.0.75, system is vulnerable.Check Version:
In Bentley View: Help > AboutVerify Fix Applied:
Verify version is updated beyond 10.15.0.75 in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of Bentley View
- Creation of suspicious child processes from Bentley View
Network Indicators:
- Outbound connections from Bentley View to suspicious IPs
- Downloads of TIF files from untrusted sources
SIEM Query:
Process Creation where Image contains 'BentleyView.exe' and CommandLine contains '.tif' or '.tiff'