CVE-2020-6321: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability (CVE-2020-6321) related to improper input validation when processing U3D files. The vulnerability was discovered and disclosed in September 2020, affecting the 3difr plugin component of the software (ZDI Advisory, NVD).

The vulnerability stems from the lack of proper initialization of a pointer prior to accessing it during the parsing of U3D files within the 3difr plugin. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-824 (Access of Uninitialized Pointer) (NVD, ZDI Advisory).

When exploited, this vulnerability can cause the application to crash and become temporarily unavailable until the user restarts it. The impact primarily affects the availability of the system, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires user interaction to be exploited, specifically the target must open a malicious U3D file received from untrusted sources. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI Advisory).

SAP has issued an update to correct this vulnerability. Users should apply the security patch as detailed in the SAP Security Note 2960815 (ZDI Advisory).