Title: Possible security vulnerability involving the ARBOR procedure when nominal target variable has double-byte formatted values that exceed 256 characters

Severity: Medium
 

Description: In SAS® Enterprise Miner™, running a node that fails with an access violation might create a possible security vulnerability.  The problem occurs when all of these conditions are true.

• The node invokes PROC ARBOR code.  Examples: Impute, Interactive Grouping, Decision Tree, Gradient Boosting, SAS Code. 
• You specify a nominal target.
• Your target variable uses double-byte formatting.
• Your target variable has double-byte formatted values that exceed 256 characters.
• The node fails with an access violation.

To avoid the problem, do not exceed 256 characters.

Potential Impact: The above condition could result in a lack of confidentiality, integrity, and/or
availability that might result in a cyber incident/cyber breach.

Operating System and Release Information

A fix for this issue for SAS Enterprise Miner 15.1 is available at: