SAS for Windows Client Application Local Buffer Overflow Vulnerability

Bugtraq ID:	65853
Class:	Boundary Condition Error
CVE:	CVE-2014-2262
Remote:	No
Local:	Yes
Published:	Feb 27 2014 12:00AM
Updated:	Mar 07 2014 07:22AM
Credit:	René Freingruber
Vulnerable:
Not Vulnerable:

SAS for Windows Client Application Local Buffer Overflow Vulnerability

SAS for Windows is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

SAS for Windows 9.2, 9.3, 9.4, 9.2 TS 2M3, 9.3 TS 1M1, 9.3 TS 1M2, and 9.4 TS 1M0 are vulnerable.

SAS for Windows Client Application Local Buffer Overflow Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

SAS for Windows Client Application Local Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SAS for Windows Client Application Local Buffer Overflow Vulnerability

References: