Microsoft Vulnerability Research Advisory MSVR12-016
Vulnerabilities in Ektron CMS Could Allow Arbitrary Code Execution
Published: | Updated:
Version: 1.1
Overview
Executive Summary
Microsoft is providing notification of the discovery and remediation of two vulnerabilities affecting Ektron Web Content Management System (CMS). Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Ektron. Ektron has remediated these vulnerabilities in their software.
The first vulnerability exists when Ektron Web CMS improperly handles user-controlled XSL data within the XslCompiledTransform class, resulting in unauthenticated arbitrary code execution. This vulnerability has been assigned the entry, CVE-2012-5357, in the Common Vulnerabilities and Exposures list.
The second vulnerability exists in the XSLTCompiledTransform function, allowing an attacker to bypass authentication. This vulnerability has been assigned the entry, CVE-2012-5358, in the Common Vulnerabilities and Exposures list.
Microsoft Vulnerability Research reported this issue to and coordinated with Ektron to ensure remediation of this issue. For more information, including information about updates from Ektron, see the latest Ektron Product Release Notes. For more information from Ektron about remediation of this issue, see the Ektron Product Release Notes for Version 8.02 SP5.
Mitigating Factors
- No mitigating factors have been identified for these vulnerabilities.
Advisory Details
Purpose and Recommendation
Purpose of Advisory: To notify users of vulnerabilities and their remediation.
Advisory Status: Advisory published.
Recommendation: Review the Suggested Actions section and configure as appropriate.
Issue References
For more information about this issue, see the following references:
| Reference | Identification |
|---|---|
| Common Vulnerabilities and Exposures | CVE-2012-5357 CVE-2012-5358 |
Affected and Non-Affected Software
This advisory discusses the following software:
| Affected Software |
|---|
| Ektron CMS version 8.02 Service Pack 4 and earlier versions |
| Non-Affected Software |
| Ektron CMS version 8.02 Service Pack 5 |
Frequently Asked Questions
What is the scope of this advisory?
This advisory is part of a coordinated release with affected vendors to inform customers of a security issue that may affect their systems.
Are these security vulnerabilities that require Microsoft to issue a security update?
No. These vulnerabilities have been fixed via an update from the affected third-party vendor. The update remediates the software listed in the table, Affected Software.
What is the scope of the vulnerabilities?
These are remote code execution vulnerabilities. An attacker who successfully exploited either of these vulnerabilities could run arbitrary code in the security context of the service running on the web server.
What causes the vulnerabilities?
Ektron CMS could be forced to transform untrusted XSLT from users in an insecure way, allowing for remote code execution in the security context of the service running on the web server.
What might an attacker use these vulnerabilities to do?
An attacker could use either of these vulnerabilities to cause a denial of service condition on the web server or to execute arbitrary code in the security context of the service running on the web server.
How could an attacker exploit the vulnerability?
An attacker could send a specially crafted requested to the server running Ektron CMS.
Suggested Actions
Update to the latest version of Ektron CMS.
Other Information
Acknowledgments
Microsoft thanks the following:
- Richard Lundeen of Microsoft, and Ektron, for working toward a resolution
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions
- V1.0 (October 16, 2012): Advisory published.
- V1.1 (November 14, 2012): Corrected affected and non-affected software versions.