^{CVE-2021-34985:}Out-of-bounds read vulnerability in Bentley ContextCapture 10.18.0.232 allows remote attackers to disclose sensitive information through malicious OBJ files.

Overview

Bentley ContextCapture is a reality modeling software application that creates 3D models from photographs and/or point clouds. The vulnerability affects version 10.18.0.232 and potentially earlier versions. The issue stems from improper validation of user input when parsing OBJ files, a common 3D geometry definition file format. When processing maliciously crafted OBJ files, the application can read beyond the bounds of an allocated buffer, potentially exposing sensitive information from memory. This vulnerability requires user interaction, as the target must either visit a malicious webpage or open a malicious file to trigger the exploit. While primarily an information disclosure vulnerability, the Zero Day Initiative (ZDI) notes that it could be leveraged alongside other vulnerabilities to achieve code execution.

Remediation

Users and administrators should take the following steps to mitigate this vulnerability:

1. Update to the latest version of Bentley ContextCapture as recommended by the vendor in their security advisory.
2. Exercise caution when opening OBJ files from untrusted sources.
3. Implement defense-in-depth strategies such as:
   • Running the application with minimal privileges
   • Using application control/whitelisting to prevent execution of unauthorized code
   • Deploying network monitoring to detect exploitation attempts
4. Follow the specific mitigation guidance provided in Bentley's security advisory (BE-2021-0001).
5. Consider implementing additional security controls like sandboxing when processing untrusted OBJ files.

References

1. Bentley Security Advisory: https://www.bentley.com/en/common-vulnerability-exposure/be-2021-0001
2. Zero Day Initiative Advisory: https://www.zerodayinitiative.com/advisories/ZDI-21-1359/
3. Common Weakness Enumeration: CWE-125 (Out-of-bounds Read)
4. Original ZDI submission reference: ZDI-CAN-14785