Providing software solutions since 1976

• Log in
• Create profile
• Welcome
  [Log out]
• Edit profile
• My SAS

• Print  |
• Feedback  |
• Share

  • E-mail
  

  E-mail This Page

  Your Name:*
  Your E-mail:*
  Recipient E-mail:*
  Send a copy to me
  Personal Message:
  
  

  * indicates a required field

**  THIS USAGE NOTE ONLY PERTAINS TO SAS 8.0 and 8.1 **
The problem was addressed and corrected in release 8.2

Sites that have installed either of the SAS spawner programs "sastcpd"
or "objspawn" could be exposing themselves to a security breach.
The potential for a security breach exists only if either the sastcpd or
the objspawn executable (which would be installed in the
!SASROOT/utilities/bin directory) has the following file ownership
and permission settings:

-rwsr-xr-x   1 root       techsup     304001 Apr 26  2000 objspawn
-rwsr-xr-x   1 root       techsup      73925 Apr 26  2000 sastcpd

If either the permissions or the ownership of the files are different
from these, then there is no exposure.

The sastcpd spawner installs as part of SAS/Base while objspawn installs
with the SAS/Integration Technologies product.  For customers who have
not installed the SAS/Integration Technologies products the only
affected file in the !SASROOT/utilities/bin directory would be sastcpd.

If neither the SAS/Connect nor SAS/Integration Technologies products are
licensed (that is if they do not appear in the setinit.sas file) then
the recommended solution is to simply change the ownership of the
file(s) any non-root ID and to change the permissions to 755 (it may be
necessary to log in as root to make these changes).

Further Explanation:

In order for the SAS applications that need to do userid authentication
to be able to function correctly, the spawner programs must have access
to userid and password information.  For this to be granted, it is
necessary for the authentication program to run as a root process.  This
can be accomplished by logging in as a root userid and then launching
the spawner program.  However, in order for any userid to be able to
launch the spawner executable and still have the spawner run as a root
process, it is nesessary for the ownership and permissions of the
spawner executable to be set as described above.

For customers who wish to have the convenience of being able to launch
these spawners without having to log in as root the following hotfix is
available for download.  It has been repaired so that it doesn't have
the security exposure.

Operating System and Release Information

A fix for this issue which can be applied to both SAS Version 8 TSLEVEL M0 and to SAS Release 8.1 (TS1M0) is available at:

A fix for Release 8.2 (TS2M0) for this issue is available at:

A fix for Release 8.2 (TS2M0) with Asian Language Suppoart (DBCS) for this issue is available at: