SUPPORT / SAMPLES & SAS NOTES
Problem Note 60265: Arbitrary redirection from SAS® 9.4 Logon Manager results in a phishing vulnerability
 |  |  |  |  |
Severity: Medium
Description: Arbitrary redirection from the logoff URL in SAS 9.4 Logon Manager results in a phishing vulnerability.
Potential Impact: It is possible that the logon service can be manipulated to redirect users to malicious URLs in order to capture their credentials or to otherwise compromise the system.
Click the Hot Fix tab in this note to access the hot fix for this issue.
Operating System and Release Information
| Product Family | Product | System | SAS Release | |
| Reported | Fixed* | |||
| SAS System | SAS Web Infrastructure Platform | Microsoft® Windows® for x64 | 9.4 TS1M0 | 9.4 TS1M5 |
| 64-bit Enabled AIX | 9.4 TS1M0 | 9.4 TS1M5 | ||
| 64-bit Enabled Solaris | 9.4 TS1M0 | 9.4 TS1M5 | ||
| HP-UX IPF | 9.4 TS1M0 | 9.4 TS1M5 | ||
| Linux for x64 | 9.4 TS1M0 | 9.4 TS1M5 | ||
| Solaris for x64 | 9.4 TS1M0 | 9.4 TS1M5 | ||