Headline
CVE-2022-42900: Common Vulnerability Exposure BE-2022-0019 | Bentley Systems
Bentley MicroStation and MicroStation-based applications may be affected by out-of-bounds read issues when opening crafted FBX files. Exploiting these issues could lead to information disclosure and code execution. The fixed versions are 10.17.01.58* for MicroStation and 10.17.01.19* for Bentley View.
Bentley ID: BE-2022-0019
CVE ID:
Severity: 7.83 (High)
CVSS v3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Publication date: 12th October 2022
Revision date: 12th October 2022
Summary
MicroStation and MicroStation-based applications may be affected by out-of-bounds read vulnerabilities when opening maliciously crafted FBX files. Exploiting these vulnerabilities could lead to information disclosure and code execution.
Details
Using an affected version of MicroStation or MicroStation-based application to open a FBX file containing maliciously crafted data can force an out-of-bounds read or force execution of arbitrary code. Exploitation of these vulnerabilities within the parsing of FBX files could enable an attacker to read information or execute code in the context of the current process.
Affected Versions of Products
Product
Affected Version
Fixed Version
MicroStation
10.17.0.* and prior versions
10.17.01.58 and more recent
Bentley View
10.17.0.* and prior version
10.17.01.19 and more recent
Recommended Mitigations
Bentley recommends updating to the latest versions of MicroStation and MicroStation-based applications. As a general best practice, it is also recommended to only open FBX files coming from trusted sources.
Acknowledgement
Thanks to Michael DePlante (@izobashi) of Trend Micro’s Zero Day Initiative
****Revision History****
Date
Description
11th July 2022
First version of the advisory