CVE-2020-6356: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability identified as CVE-2020-6356. The vulnerability allows users to open manipulated BMP files received from untrusted sources, which can result in the application crashing and becoming temporarily unavailable until restart (CVE Details).

The vulnerability stems from improper validation of user-supplied data during BMP file parsing, which can result in an out-of-bounds write condition. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw is classified under CWE-787 (Out-of-bounds Write) (ZDI Advisory).

When successfully exploited, this vulnerability can allow remote attackers to execute arbitrary code on affected installations of SAP 3D Visual Enterprise Viewer. The attack requires user interaction, specifically opening a malicious file or visiting a malicious page. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to be exploited, where the target must visit a malicious page or open a malicious file. The attack vector is network-accessible with low attack complexity (ZDI Advisory).

SAP has issued an update to correct this vulnerability. Users are advised to apply the security patch as detailed in the SAP Security Note 2960815 (ZDI Advisory).