Severity: High

Description: The web application does not properly reset a session value after you log on, which makes the application susceptible to session fixation.

Potential Impact: An attacker can gain access to the application through a valid user's authenticated session.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Note: After you apply the hot fix, the following new Java argument is introduced:

This new argument ensures that the session value is set correctly after you log on.

This new Java argument is required for all web application servers. So, you need to add it to the wrapper.conf file, as follows:

In Microsoft Windows operating environments:

1. Locate the wrapper.conf file in the following directories:
    
   • SAS-configuration-directory\Lev1\Web\WebAppServer\SASServer1_1\conf
   
   
   • SAS-configuration-directory\Lev1\Web\WebAppServer\SASServer6_1\conf
2. Add the new argument to the file, as shown here:
   wrapper.java.additional.XX=-Dsas.session.fixation=migrateSession

   Note: In the wrapper.java.additional.XX property, XX specifies the next number in the sequence that already exists in the file. Modify XX to be the next number in that sequence.

In Linux and other UNIX operating environments:

1. Locate the setenv.sh file is located in these directories
    
   • SAS-configuration-directory/Lev1/Web/WebAppServer/SASServer1_1/bin
   
   
   • SAS-configuration-directory/Lev1/Web/WebAppServer/SASServer6_1/bin
2. Add the new argument to the JAVA_OPTS= property, as shown below:
   JAVA_OPTS="$JAVA_OPTS -Dsas.session.fixation=migrateSession"

   You also can add the Java argument at the beginning of the JVM_OPTS, as shown below:

   JVM_OPTS="-Dsas.session.fixation=migrateSession -Xmx1536m -Xss256k -Xms768m . . .more options. . .

After you add the argument to the appropriate file for your operating system, restart the middle tier for the settings to take effect.

Operating System and Release Information

A fix for this issue for SAS Marketing Automation 6.6 is available at:

A fix for this issue for SAS Marketing Automation 6.5 is available at:

A fix for this issue for SAS Middle Tier 9.4_M3 is available at: