The SAS Environment Manager agent listens on port 2144 for plug-in updates from the SAS Environment Manager server. The agent supports Secure Sockets Layer (SSL) 3.0 and, thus, is susceptible to the POODLE vulnerability and other vulnerabilities in SSL 3.0. The POODLE vulnerability is described in the following documents:

• https://www.us-cert.gov/ncas/alerts/TA14-290A
• https://www.openssl.org/~bodo/ssl-poodle.pdf

You can address this issue in SAS 9.4 TS1M0, TS1M1, and TS1M2 by upgrading to the latest version of the SAS Private Java Runtime Environment (JRE), in which SSL 3.0 is disabled by default. For details about upgrading the SAS Private JRE, see SAS Note 56203, "Downloading the SAS® Private Java Runtime Environment Version 7 update for SAS® 9.3 and SAS® 9.4."

Operating System and Release Information