CVE-2012-3292 The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to....
HighCVSS 7.6
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/globus-gridftp-server(Debian:12) | < 6.5-1 | 6.5-1 |
| debian/globus-gridftp-server(Debian:13) | < 6.5-1 | 6.5-1 |
| debian/globus-gridftp-server(Debian:14) | < 6.5-1 | 6.5-1 |
| globus toolkit | <= 5.2.1 | No fix listed |
| globus toolkit | = 2.0 | No fix listed |
| globus toolkit | = 2.2 | No fix listed |
| globus toolkit | = 2.4.3 | No fix listed |
| globus toolkit | = 3.0.2 | No fix listed |
| globus toolkit | = 3.2.1 | No fix listed |
| globus toolkit | = 4.0.0 | No fix listed |
| globus toolkit | = 4.0.1 | No fix listed |
| globus toolkit | = 4.0.2 | No fix listed |
| globus toolkit | = 4.0.3 | No fix listed |
| globus toolkit | = 4.0.4 | No fix listed |
| globus toolkit | = 4.0.5 | No fix listed |
| globus toolkit | = 4.0.6 | No fix listed |
| globus toolkit | = 4.0.7 | No fix listed |
| globus toolkit | = 4.0.8 | No fix listed |
| globus toolkit | = 4.2.0 | No fix listed |
| globus toolkit | = 4.2.1 | No fix listed |
| globus toolkit | = 5.0.0 | No fix listed |
| globus toolkit | = 5.0.1 | No fix listed |
| globus toolkit | = 5.0.2 | No fix listed |
| globus toolkit | = 5.0.3 | No fix listed |
| globus toolkit | = 5.0.4 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| globus toolkit | = 5.0.5 | No fix listed |
| globus toolkit | = 5.2.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-3292 vendor-advisory
- jira.globus.org
- FEDORA-2012-8488 vendor-advisory
- FEDORA-2012-8461 vendor-advisory
- FEDORA-2012-8445 vendor-advisory
- DSA-2523 vendor-advisory