Close inspection of the webserver and web application server installed with SAS 9.4 (AIX) reveals that both are quite old:
apache 2.2.26 vs. current version 2.2.32 on apache.org; 2.2 is already labeled "legacy" and should be replaced with the current 2.4 release.
tomcat 6.0.35 or 7.0.30 vs 6.0.53 and 7.0.77 on apache.org
It strikes me as awkward that a company like SAS has to revert to a 3rd party for open-source software; I'd rather have expected to have an in-house team that rolls their own distribution, and keeps it current for download, so a customer does not have to wait for a complete SAS TM to bring that up-to-date. Keep in mind that both programs do have security issues every now and then.