Update ActiveMQ on SAS 9.4 Server for CVE-2023-46604

[aalborz-ema]

A recent vulnerability scan has identified the version of ActiveMQ currently running on our SAS 9.4 server to be vulnerable.

I found a relevant article (Updates available for SAS Environment Manager 2.5_M4 : Hot fix J9V014 - SAS Support Communities) in the community forum, but my questions are:

Will updating the SAS Environment Manager remediate the ActiveMQ vulnerability?

How do I run/access SAS Environment Manager? I'm not seeing it under SAS in Start menu.

[gwootton]

Here's the SAS statement on the vulnerability along with remediation steps:
https://support.sas.com/en/security-bulletins/apache-activemq-vulnerability.html

[aalborz-ema]

Thanks Greg! I figured out the SAS Deployment Manager HotFix install for the ActiveMQ client.

However, even after stopping all the SAS services, when I run the hotfix thru via DM, it's complaining about open/in use files, including activemq client. How do I get around that?

[gwootton]

You could restart your host, that should release any open files.