PT-2022-25700 · Sap · Sap 3D Visual Enterprise Author

Published 2022-10-11 · Updated 2023-07-10 · CVE-2022-41177

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP 3D Visual Enterprise Author version 9

Description The issue arises due to improper memory management when handling manipulated Iges Part and Assembly files. This can lead to a Remote Code Execution when a payload forces a stack-based overflow or reuses a dangling pointer referring to overwritten memory space.

Recommendations For SAP 3D Visual Enterprise Author version 9, consider avoiding the use of CoreCadTranslator.exe for handling .igs and .iges files from untrusted sources until a patch is available. As a temporary workaround, restrict the opening of such files to minimize the risk of exploitation.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

CVE-2022-41177

ZDI-22-1553

ZDI-22-1554

ZDI-22-1556

ZDI-22-1557

Affected Products

Sap 3D Visual Enterprise Author

References · 8

• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3245929 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1554 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1553 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1556 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1557 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41177 · Vendor Advisory