PT-2022-25693 · Sap+1 · Sap 3D Visual Enterprise Author+1

Published 2022-10-11 · Updated 2023-07-10 · CVE-2022-41170

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP 3D Visual Enterprise Author version 9

Description The issue arises due to improper memory management. When a victim opens a manipulated CATIA4 Part (.model, CatiaTranslator.exe) file from untrusted sources, it can trigger Remote Code Execution. This occurs when the payload forces a stack-based overflow or reuses a dangling pointer referring to overwritten space in memory.

Recommendations For SAP 3D Visual Enterprise Author version 9, avoid opening CATIA4 Part (.model, CatiaTranslator.exe) files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of the CatiaTranslator.exe until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

CVE-2022-41170

ZDI-22-1559

Affected Products

Catia

Sap 3D Visual Enterprise Author

References · 6

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41170 · Security Note
• https://launchpad.support.sap.com/#/notes/3245929 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1559 · Security Note
• https://t.me/cibsecurity/51187 · Telegram Post