PT-2012-4628 · Globus · Globus Toolkit

Publicado 2012-06-07 · Atualizado 2012-09-07 · CVE-2012-3292

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Globus Toolkit versions prior to 5.2.2

Description The issue is related to the GridFTP component in Globus Toolkit, where it fails to properly check the return value from the getpwnam r function when certain autoconf macros are defined. This could potentially allow remote attackers to gain privileges by logging in with a non-existent user, causing GridFTP to run as the last user in the password file.

Recommendations For versions prior to 5.2.2, update to version 5.2.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-3292

DSA-2523-1

Produtos afetados

Globus Toolkit

Referências · 9

• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3292 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-3292 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-3292 · Aviso do Fabricante
• http://jira.globus.org/browse/GT-195 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3292 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2523 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html · Aviso do Fabricante