Login Sign Up

CVE-2021-27585

7.8 HIGH
Denial of Service

📋 TL;DR

This vulnerability in SAP 3D Visual Enterprise Viewer version 9 allows attackers to cause a denial of service by crashing the application when users open specially crafted CGM files. The vulnerability affects users who open untrusted CGM files with this specific SAP viewer software.

💻 Affected Systems

Products:
  • SAP 3D Visual Enterprise Viewer
Versions: Version 9
Operating Systems: Windows, Linux
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects version 9 of the SAP 3D Visual Enterprise Viewer when opening CGM files.

📦 What is this software?

3d Visual Enterprise Viewer by Sap

View all CVEs affecting 3d Visual Enterprise Viewer →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Application crashes and becomes unavailable until restarted, potentially disrupting business workflows that rely on this viewer.

🟠

Likely Case

Users experience application crashes when opening malicious CGM files, requiring application restart and potential data loss in unsaved work.

🟢

If Mitigated

With proper controls, users avoid opening untrusted CGM files, preventing exploitation and maintaining application availability.

🌐 Internet-Facing: LOW - This requires user interaction to open malicious files and is not directly exploitable over network interfaces.
🏢 Internal Only: MEDIUM - Internal users could be targeted via phishing or shared malicious files, causing productivity disruption.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires user interaction to open malicious CGM files. No authentication bypass needed beyond file access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apply SAP Security Note 3027758

Vendor Advisory: https://launchpad.support.sap.com/#/notes/3027758

Restart Required: Yes

Instructions:

1. Access SAP Support Portal. 2. Download Security Note 3027758. 3. Apply the patch according to SAP documentation. 4. Restart the application.

🔧 Temporary Workarounds

Restrict CGM file handling

all

Configure system to open CGM files with alternative applications or block CGM file execution in SAP 3D Visual Enterprise Viewer.

Windows: Use Group Policy to modify file associations
Linux: Update mime-type associations to use alternative viewers

User awareness training

all

Train users not to open CGM files from untrusted sources.

🧯 If You Can't Patch

  • Implement application whitelisting to prevent execution of malicious CGM files
  • Use email/web gateways to block CGM file attachments from untrusted sources

🔍 How to Verify

Check if Vulnerable:

Check if SAP 3D Visual Enterprise Viewer version 9 is installed and if Security Note 3027758 is not applied.

Check Version:

Windows: Check application properties or registry. Linux: Check package manager or installation directory.

Verify Fix Applied:

Verify Security Note 3027758 is applied and application version is updated.

📡 Detection & Monitoring

Log Indicators:

  • Application crash logs mentioning CGM file processing
  • Error logs related to SAP 3D Visual Enterprise Viewer abnormal termination

Network Indicators:

  • Unusual CGM file downloads to user workstations

SIEM Query:

source="application_logs" AND (process="SAP 3D Visual Enterprise Viewer" AND event="crash")

📊 Metadata

CVE ID: CVE-2021-27585
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: March 9, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON