65230 - SAS® 9.4M6 Logon Manager does not impose size restrictions on the user-ID and password input fields

Problem Note 65230: SAS® 9.4M6 Logon Manager does not impose size restrictions on the user-ID and password input fields

Severity: Low

Description: SAS 9.4M6 Logon Manager does not impose size restrictions on the user-ID and password input fields.

Potential Impact: An attacker might attempt a Denial of Service attack by submitting arbitrarily large values on the logon page.

Click the Hot Fix tab in this note to access the hot fix for this issue.

Product Family	Product	System	Product Release		SAS Release
Product Family	Product	System	Reported	Fixed*	Reported	Fixed*
SAS System	SAS Viya	Linux for x64	3.5		Viya
SAS System	SAS Viya	Microsoft® Windows® for x64	3.5		Viya
SAS System	SAS Web Infrastructure Platform	Solaris for x64	9.4_M6		9.4 TS1M6
		Linux for x64	9.4_M6		9.4 TS1M6
		HP-UX IPF	9.4_M6		9.4 TS1M6
		64-bit Enabled Solaris	9.4_M6		9.4 TS1M6
		64-bit Enabled AIX	9.4_M6		9.4 TS1M6
		Microsoft® Windows® for x64	9.4_M6		9.4 TS1M6

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

A fix for this issue for SAS Middle Tier 9.4_M6 is available at:

Type:	Problem Note
Priority:	high

Date Modified:	2020-07-22 08:17:14
Date Created:	2019-12-10 11:15:36