PT-2021-17523 · Sap · Sap 3D Visual Enterprise Viewer

Xina1I · Published 2021-03-09 · Updated 2021-03-25 · CVE-2021-27585

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP 3D Visual Enterprise Viewer version 9

Description The issue occurs when a user opens manipulated Computer Graphics Metafile (.CGM) format files received from untrusted sources, causing the application to crash and become temporarily unavailable until restart. This is related to a memory corruption and stack-based buffer overflow issue when parsing CGM files.

Recommendations For SAP 3D Visual Enterprise Viewer version 9, consider avoiding the use of CGM file parsing functionality until a patch is available. As a temporary workaround, restrict the opening of .CGM files from untrusted sources to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-27585

ZDI-21-288

ZDI-21-299

Affected Products

Sap 3D Visual Enterprise Viewer

References · 9

• https://zerodayinitiative.com/advisories/ZDI-21-299 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27585 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=571343107 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-288 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27585 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3027758 · Vendor Advisory
• https://t.me/cvenotify/11346 · Telegram Post
• https://t.me/cvenotify/11941 · Telegram Post
• https://t.me/cibsecurity/24600 · Telegram Post