In certain cases, security vulnerabilities might be reported for the EJBInvokerServlet and JMXInvokerServlet applications on the JBoss application server. Because the SAS^® Enterprise business server does not need these applications, it is safe to remove them from JBoss in order to avoid these security vulnerabilities.

Note: Be aware that these vulnerabilities are not in the SAS^® software. They are specifically in the EJBInvokerServer and JMXInvokerServlet applications that are deployed on JBoss.

To remove the EJBInvokerServlet and JMXInvokerServlet applications:

1. Stop the JBoss application server.
2. Delete the SASServerx/tmp and SASServerx/work directories.
3. Remove the following directories from JBoss. (These directories need to be removed completely or to be outside of the Jboss structure. Otherwise, JBoss will still find and deploy them.)
• JBoss-home-directory\server\SASServer1\deploy\http-invoker.sar
• JBoss-home-directory\server\SASServer1\deploy\jmx-console.war
• JBoss-home-directory\server\SASServer1\deploy\management
4. Restart JBoss.

To remove the Java Management Extensions (JMX) Console:

1. Stop the JBoss application server.
2. Delete the SASServerx/tmp and SASServerx/work directories.
3. Remove the following directories ((These directories need to be removed completely or to be outside of the JBoss structure. Otherwise, JBoss will still find and deploy them.)
• JBoss-home-directory/common/deploy/jmx-console.war
• JBoss-home-directory/server/node/deploy/jmx-console-activator-jboss-beans.xml
4. Restart JBoss.

Note: If you decide to secure the JXM Console rather than remove it, see the instructions in SAS Note 41650, "Securing the Java Management Extensions (JMX) and Web Console applications for the community version of JBoss application server."

Operating System and Release Information