Vulnerability Note VU#985449
SAP AG SAPgui EAI WebViewer3D ActiveX control stack buffer overflow
The Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control, which comes with SAPgui, contains a stack buffer overflow. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
SAP AG SAPgui includes an ActiveX control called EAI WebViewer3D, which is produced by Unigraphics Solutions, a division of Siemens. The EAI WebViewer3D ActiveX control, which is provided by webviewer3d.dll, contains a stack buffer overflow in the SaveViewToSessionFile() method. Although the ActiveX control is produced by Siemens, it is reported to only be used by SAP.
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause the web browser to crash.
Apply an update
This issue is addressed with SAPgui 7.10 Patch Level 9. This update sets the kill bit for the vulnerable control, since it was not intended for use in Internet Explorer. Although the SAPgui 7.10 Patch Level 8 release notes indicate that the control is disabled via the kill bit, please note that the kill bit was not properly set until Patch Level 9. Please also consider the following workarounds:
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|SAP||Affected||21 Jul 2008||31 Mar 2009|
|Siemens CERT||Affected||07 Jul 2007||16 Feb 2009|
|Unigraphics Solutions||Affected||29 Oct 2007||16 Feb 2009|
CVSS Metrics (Learn More)
This vulnerability was reported by Will Dormann of the CERT/CC.
This document was written by Will Dormann.
- CVE IDs: CVE-2007-4475
- Date Public: 31 Mar 2009
- Date First Published: 31 Mar 2009
- Date Last Updated: 13 Apr 2009
- Severity Metric: 10.48
- Document Revision: 18
If you have feedback, comments, or additional information about this vulnerability, please send us email.