Problem Note 62945: SAS® Infrastructure Data Server update addresses known security vulnerabilities
 |  |  |  |  |
Severity: High
Description: SAS® Infrastructure Data Server 9.4, which functions as a PostgreSQL database, is delivered with SAS® Viya® 3.4. The following security concerns related to PostgreSQL are present in this release of the SAS data server:
Potential Impact:
- Unprivileged users might be able to execute arbitrary code as the PostgreSQL service account.
- A flaw was discovered in PostgreSQL in which arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
Updating the PostgreSQL server from 9.4 to 9.4.24 addresses all of these security concerns.
Click the Hot Fix tab in this note to access the hot fix for this issue.
Operating System and Release Information
| Product Family | Product | System | Product Release | SAS Release | ||
| Reported | Fixed* | Reported | Fixed* | |||
| SAS System | SAS Viya | Linux for x64 | 3.4 | 3.5 | ||
| Microsoft® Windows® for x64 | 3.4 | 3.5 | Viya | |||
An update for this issue is available for SAS Viya 3.3. For instructions on how to access and apply software updates, see the Managing Your Software section of the SAS Viya 3.3 Administration document at
http://documentation.sas.com/?softwareId=administration&softwareVersion=3.3&softwareContextId=softwareUpdatesAn update for this issue is available for SAS Viya 3.2. For instructions on how to access and apply software updates, see the Software Updates section of the SAS Viya 3.2 Administration document at
http://documentation.sas.com/?softwareId=administration&softwareVersion=3.2&softwareContextId=softwareUpdatesAn update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Windows Deployment Guide at
http://documentation.sas.com/?softwareId=administration&softwareVersion=3.4&softwareContextId=softwareUpdatesWinAn update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at
http://documentation.sas.com/?softwareId=administration&softwareVersion=3.4&softwareContextId=softwareUpdatesViya on Linux: An update for this issue is available for SAS Viya 3.4. For instructions on how to access and apply software updates, see the Updating Your SAS Viya software section in the SAS Viya 3.4 for Linux Deployment Guide at
http://documentation.sas.com/?softwareId=administration&softwareVersion=3.4&softwareContextId=softwareUpdatesA fix for this issue for SAS Web Infrastructure Platform Data Server 9.4_M6 is available at:
https://tshf.sas.com/techsup/download/hotfix/HF2/F6P.html#62945| Type: | Problem Note |
| Priority: | high |
| Topic: | Data Management ==> Data Sources ==> External Databases ==> PostgreSQL |
| Date Modified: | 2019-06-27 10:09:18 |
| Date Created: | 2018-09-18 12:18:43 |