PT-2012-4628 · Globus · Globus Toolkit

Published 2012-06-07 · Updated 2012-09-07 · CVE-2012-3292

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Globus Toolkit versions prior to 5.2.2

Description The issue is related to the GridFTP component in Globus Toolkit, where it fails to properly check the return value from the getpwnam r function when certain autoconf macros are defined. This could potentially allow remote attackers to gain privileges by logging in with a non-existent user, causing GridFTP to run as the last user in the password file.

Recommendations For versions prior to 5.2.2, update to version 5.2.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3292

DSA-2523-1

Affected Products

Globus Toolkit

References · 9

• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3292 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-3292 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3292 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3292 · Vendor Advisory
• http://debian.org/security/2012/dsa-2523 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html · Vendor Advisory
• http://jira.globus.org/browse/GT-195 · Note