Microsoft Vulnerability Research Advisory MSVR12-016
Vulnerabilities in Ektron CMS Could Allow Arbitrary Code Execution
Published: | Updated:
Microsoft is providing notification of the discovery and remediation of two vulnerabilities affecting Ektron Web Content Management System (CMS). Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Ektron. Ektron has remediated these vulnerabilities in their software.
The first vulnerability exists when Ektron Web CMS improperly handles user-controlled XSL data within the XslCompiledTransform class, resulting in unauthenticated arbitrary code execution. This vulnerability has been assigned the entry, CVE-2012-5357, in the Common Vulnerabilities and Exposures list.
The second vulnerability exists in the XSLTCompiledTransform function, allowing an attacker to bypass authentication. This vulnerability has been assigned the entry, CVE-2012-5358, in the Common Vulnerabilities and Exposures list.
Microsoft Vulnerability Research reported this issue to and coordinated with Ektron to ensure remediation of this issue. For more information, including information about updates from Ektron, see the latest Ektron Product Release Notes. For more information from Ektron about remediation of this issue, see the Ektron Product Release Notes for Version 8.02 SP5.
- No mitigating factors have been identified for these vulnerabilities.
Purpose of Advisory: To notify users of vulnerabilities and their remediation.
Advisory Status: Advisory published.
Recommendation: Review the Suggested Actions section and configure as appropriate.
For more information about this issue, see the following references:
|Common Vulnerabilities and Exposures||CVE-2012-5357 |
This advisory discusses the following software:
|Ektron CMS version 8.02 Service Pack 4 and earlier versions|
|Ektron CMS version 8.02 Service Pack 5|
Microsoft thanks the following:
- Richard Lundeen of Microsoft, and Ektron, for working toward a resolution
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
- V1.0 (October 16, 2012): Advisory published.
- V1.1 (November 14, 2012): Corrected affected and non-affected software versions.