Severity: Critical

Description: Multiple SAS^® middle-tier components that are included with SAS^® 9.4 software [up to and including release 9.4M6 (TS1M6)] contain the Apache commons-file-upload-1.3.3 library that is vulnerable to the situation that is described in CVE-2016-1000031.

Potential Impact: An attacker might execute malicious code remotely on the server.

Remediation Notes: You can safely remove the vulnerable components by removing the following files:

• SAS-configuration-directory/Lev1/Web/gemfire/tools/Extensions/gemfire.war
• SAS-configuration-directory/Lev1/Web/gemfire/tools/Extensions/gemfire-api.war.
• SAS-configuration-directory/Lev1/Web/Scripts/WebServer/src/Config/vfabrictcsvr/gemfire.zip
• SAS-configuration-directory/Lev1/Web/Scripts/SASEnvironmentManager/src/Config/vfabrictcsvr/gemfire.zip
• SAS-configuration-directory/Lev1/Web/Scripts/SASEnvironmentManagerAgent/src/Config/vfabrictcsvr/gemfire.zip