Was this page helpful?
Additional feedback?
1500 characters remaining
Export (0) Print
Expand All

Microsoft Vulnerability Research Advisory MSVR12-016

Vulnerabilities in Ektron CMS Could Allow Arbitrary Code Execution

Published: October 16, 2012 | Updated: November 14, 2012

Version: 1.1


Executive Summary

Microsoft is providing notification of the discovery and remediation of two vulnerabilities affecting Ektron Web Content Management System (CMS). Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affected vendor, Ektron. Ektron has remediated these vulnerabilities in their software.

The first vulnerability exists when Ektron Web CMS improperly handles user-controlled XSL data within the XslCompiledTransform class, resulting in unauthenticated arbitrary code execution. This vulnerability has been assigned the entry, CVE-2012-5357, in the Common Vulnerabilities and Exposures list.

The second vulnerability exists in the XSLTCompiledTransform function, allowing an attacker to bypass authentication. This vulnerability has been assigned the entry, CVE-2012-5358, in the Common Vulnerabilities and Exposures list.

Microsoft Vulnerability Research reported this issue to and coordinated with Ektron to ensure remediation of this issue. For more information, including information about updates from Ektron, see the latest Ektron Product Release Notes. For more information from Ektron about remediation of this issue, see the Ektron Product Release Notes for Version 8.02 SP5.

Mitigating Factors

  • No mitigating factors have been identified for these vulnerabilities.

Advisory Details

Purpose and Recommendation

Purpose of Advisory: To notify users of vulnerabilities and their remediation.

Advisory Status: Advisory published.

Recommendation: Review the Suggested Actions section and configure as appropriate.

Issue References

For more information about this issue, see the following references:

Common Vulnerabilities and Exposures CVE-2012-5357 

Affected and Non-Affected Software

This advisory discusses the following software:

Affected Software
Ektron CMS version 8.02 Service Pack 4 and earlier versions
Non-Affected Software
Ektron CMS version 8.02 Service Pack 5

What is the scope of this advisory? 
This advisory is part of a coordinated release with affected vendors to inform customers of a security issue that may affect their systems.

Are these security vulnerabilit ies that require Microsoft to issue a security update? 
No. These vulnerabilities have been fixed via an update from the affected third-party vendor. The update remediates the software listed in the table, Affected Software.

What is the scope of the vulnerabilit ies ? 
These are remote code execution vulnerabilities. An attacker who successfully exploited either of these vulnerabilities could run arbitrary code in the security context of the service running on the web server.

What causes the vulnerabilit ies ? 
Ektron CMS could be forced to transform untrusted XSLT from users in an insecure way, allowing for remote code execution in the security context of the service running on the web server.

What might an attacker use th ese vulnerabilit ies to do? 
An attacker could use either of these vulnerabilities to cause a denial of service condition on the web server or to execute arbitrary code in the security context of the service running on the web server.

How could an attacker exploit the vulnerability? 
An attacker could send a specially crafted requested to the server running Ektron CMS.

Update to the latest version of Ektron CMS.

Other Information


Microsoft thanks the following:

  • Richard Lundeen of Microsoft, and Ektron, for working toward a resolution


The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.


  • V1.0 (October 16, 2012): Advisory published.
  • V1.1 (November 14, 2012): Corrected affected and non-affected software versions.

Built at 2014-04-18T13:49:36Z-07:00

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
© 2015 Microsoft