CVE-2014-2262 Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.
HighCVSS 9.3
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sas base sas | = 9.2-ts2m | No fix listed |
| sas base sas | = 9.3-ts1m1 | No fix listed |
| sas base sas | = 9.3-ts1m2 | No fix listed |
| sas base sas | = 9.4-ts1m0 | No fix listed |
References
- 57029 third-party-advisory vendor-advisory
- support.sas.com vendor-advisory
- 20140227 SEC Consult SA-20140227-0 :: Local Buffer Overflow vulnerability in SAS for Windows (Statistical Analysis System) mailing-list
- 65853 vdb-entry
- www.sec-consult.com