CVE-2020-6335: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

CVE-2020-6335 affects SAP 3D Visual Enterprise Viewer version 9. The vulnerability was discovered and disclosed in September 2020, allowing remote attackers to manipulate HPGL files that can cause the application to crash and become temporarily unavailable until restart (ZDI Advisory, NVD).

The vulnerability stems from improper input validation when processing HPGL files within the hpgl plugin. Specifically, the issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer (out-of-bounds write). The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (NVD, ZDI Advisory).

When exploited, this vulnerability can cause the SAP 3D Visual Enterprise Viewer application to crash and become temporarily unavailable until the user restarts the application. The impact is limited to availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires user interaction to be exploited, specifically the target must open a malicious HPGL file. An attacker can leverage this vulnerability to cause a denial of service condition (ZDI Advisory).

SAP has issued an update to correct this vulnerability. Users are advised to apply the security patch as detailed in SAP Security Note 2960815 (ZDI Advisory).