topic Re: Bug in der commons-collection library - effects for JBOSS in SAS Web Application unclear in Administration and Deployment

Bug in der commons-collection library - effects for JBOSS in SAS Web Application unclear

Gkrause — Wed, 13 Jan 2016 08:52:46 GMT

Hi Guys!

This is a rather general question. There is a security bug which affects the JBOSS-Servers (check: https://bugzilla.redhat.com/show_bug.cgi?id=1279330). A lot of SAS-Webapplications are using JBOSS, i wonder what effect this may have on these applications.

Thanks.

Gunnar

Re: Bug in der commons-collection library - effects for JBOSS in SAS Web Application unclear

anja — Thu, 14 Jan 2016 13:15:45 GMT

Hi Gunnar,

please take a look at the folllowing link. Is this what you are looking for?

http://support.sas.com/security/Java-deserialization.html

Thanks

Anja

Re: Bug in der commons-collection library - effects for JBOSS in SAS Web Application unclear

boemskats — Thu, 14 Jan 2016 16:20:21 GMT

Hi Gunnar,

I highly recommend reading through this note if it applies to your version of JBoss:

https://access.redhat.com/solutions/30744

It's an older vulnerability with a poorly secured JMX console. Although you should be ok if you're running on an internal network and/or non-standard port, you should exercise extreme caution if you're running a publically accessible SAS server without a reverse proxy. I've had to chase a couple of trojans down, it's not fun. The fix in that link is relatively straightforward.

Hope this helps.

Nik

Re: Bug in der commons-collection library - effects for JBOSS in SAS Web Application unclear

Gkrause — Fri, 15 Jan 2016 09:18:49 GMT

Hi Anja,

yes this is exatctly the issue but the link does not show any solution. It is just a notification that sas knows about the issue.

Anyhow...I am not really sure if this is a SAS responsibility or if the people behind JBoss must act here?

Thanks.

Gunnar