CVE-2020-6374: 
SAP 3D Visual Enterprise Viewer vulnerability analysis and mitigation

SAP 3D Visual Enterprise Viewer version 9 contains a vulnerability that allows an attacker to cause the application to crash by opening manipulated Jupiter Tessallation (.jt) files from untrusted sources. The vulnerability (CVE-2020-6374) was disclosed in October 2020 and is caused by improper input validation (ZDI Advisory, NVD).

The vulnerability exists within the parsing of JT files and results from the lack of proper validation of user-supplied data, which can lead to a read before the start of an allocated buffer. The issue has been assigned CVSS v3.1 base scores of 7.8 (HIGH) by NIST and 4.3 (MEDIUM) by SAP SE. The vulnerability is classified as CWE-20 (Improper Input Validation) and CWE-125 (Out-of-bounds Read) (NVD).

When exploited, this vulnerability causes the application to crash and become temporarily unavailable until the user restarts the application. The crash occurs due to improper validation of input when processing specially crafted Jupiter Tessallation files (ZDI Advisory).

The vulnerability requires user interaction to exploit, as the target must open a malicious file. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI Advisory).

The vulnerability was fixed in SAP 3D Visual Enterprise Viewer version 9.0 FP09 MP3. Users should update to this version or later to mitigate the vulnerability (ZDI Advisory).