SAS Statement Regarding CVE 2014-6271 (the Bash Vulnerability) Updated Statement: SAS is aware of CVE 2014-6271 (and associated CVEs, including CVE-2014-7169, CVE-2014-7186 and CVE-2014-7187) -- also known as the Bash or "Shellshock" vulnerability -- made public September 24th, 2014. We have been evaluating our systems and our products and report the following assessment and recommendations. Assessment and Recommended Actions: SAS has proactively taken steps to ensure Hosted customers and customers running SAS University Edition are protected from potential exploits. The SAS University Edition is minimally affected by CVE 2014-6271; SAS University Edition is locked down in terms of network capabilities and shell command access. An update was released September 27, 2014 to the SAS University Edition which addresses the vulnerability and we recommend that all users either apply the update to their existing vApp or download a new, updated copy. See FAQ: How do I update the SAS University Edition vApp for instructions on how to update the SAS University Edition. SAS has not identified any additional vulnerabilities. We continue to encourage SAS customers who are working with an operating system vendor external to SAS to consult that vendor for any patches that have been made available. Original Statement, Posted 3:00 P.M. ET, Friday, September 26, 2014: SAS is aware of CVE 2014-6271 -- also known as the Bash or "Shellshock" vulnerability -- made public September 24th, 2014. We are evaluating our systems and our products so that we can recommend an appropriate course of action, if necessary. We encourage any SAS customers who are working with an operating system vendor external to SAS to consult that vendor for any patches that have been made available. CONTACT US If you have concerns or questions, please contact your SAS account representative or SAS Technical Support. Privacy Statement Terms of Use and Legal Information Copyright © SAS Institute Inc. All rights reserved.

SAS Login Your profile establishes a login for use across the SAS web site. Use this login to pre-fill forms, manage your subscriptions, gain access to restricted content and more. Already Have a Profile? Email: Password: Keep me logged in Login Forgot Password? Need Help? New User? Create your profile to take full advantage of our site. Create Why Create a Profile? Get social - join SAS communities. Get help - follow your tech support questions. Get software - download software/hot fixes. Get informed - manage e-learning/newsletters. Privacy Statement | Terms of Use and Legal Information Copyright © SAS Institute Inc. All rights reserved.