Problem Note 34727: Users of SAS® Credit Risk Studio might be able to access server files without being granted permissions
Users of SAS Credit Risk Studio might be able to access server files without explicitly being granted permissions to do so.
For example, criskuser1 and criskuser2 are SAS Credit Risk Studio users that have not been granted permission to view one another's files on the SAS® Credit Risk Management for Banking Server. User criskuser1 should not be able to access criskuser2 server files. However, by exploiting the SAS Credit Risk Studio file servlet, criskuser1 might be able to access the criskuser2 server files that are associated with a given URL.
Select the Hot Fix tab in this note to access the hot fix for this issue.
Operating System and Release Information
| SAS System | SAS Credit Risk Management | Microsoft Windows NT Workstation | 4.5 | | 9.1 TS1M3 SP4 | |
| Microsoft Windows 2000 Professional | 4.5 | | 9.1 TS1M3 SP4 | |
| Microsoft Windows 2000 Server | 4.5 | | 9.1 TS1M3 SP4 | |
| Microsoft Windows 2000 Datacenter Server | 4.5 | | 9.1 TS1M3 SP4 | |
| Microsoft Windows 2000 Advanced Server | 4.5 | | 9.1 TS1M3 SP4 | |
| Microsoft Windows Server 2003 Datacenter Edition | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| Microsoft Windows Server 2003 Enterprise Edition | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| Microsoft Windows Server 2003 Standard Edition | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| Microsoft Windows XP Professional | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| Windows Vista | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| 64-bit Enabled AIX | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| 64-bit Enabled HP-UX | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
| 64-bit Enabled Solaris | 4.5 | 4.6 | 9.1 TS1M3 SP4 | 9.2 TS2M2 |
*
For software releases that are not yet generally available, the Fixed
Release is the software release in which the problem is planned to be
fixed.
| Type: | Problem Note |
| Priority: | alert |
| Date Modified: | 2009-04-07 10:08:10 |
| Date Created: | 2009-02-06 13:43:56 |
