CVE-2020-6349: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability (CVE-2020-6349) related to improper input validation when processing GIF files. The vulnerability was discovered and disclosed in September 2020, affecting the application's ability to handle manipulated GIF files from untrusted sources (ZDI Advisory, NVD).

The vulnerability stems from the lack of proper validation of user-supplied data during GIF file parsing, which can result in a memory corruption condition. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) by NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, while ZDI assessed it with a higher CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability is classified under CWE-787 (Out-of-bounds Write) (NVD, ZDI Advisory).

When exploited, this vulnerability can cause the application to crash and become temporarily unavailable until the user restarts it. Additionally, according to the ZDI assessment, successful exploitation could potentially lead to arbitrary code execution in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must open a malicious GIF file. The attack vector is network-based with low attack complexity and requires no privileges, though user interaction is required (ZDI Advisory).

SAP has issued an update to correct this vulnerability. Users are advised to apply the security update as detailed in the SAP Security Note 2960815 (ZDI Advisory).