Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-3292

Overview

Vulnerability Score 7.6 7.6
CVE Id CVE-2012-3292
Last Modified 07 Sep 2012 12:30:25
Published 07 Jun 2012 04:55:02
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity HIGH
Authentication NONE

CVE-2012-3292

Summary

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.

Vulnerable Systems

Application

  • Globus Toolkit 2.0

  • Globus Toolkit 2.2

  • Globus Toolkit 2.4.3

  • Globus Toolkit 3.0.2

  • Globus Toolkit 3.2.1

  • Globus Toolkit 4.0.0

  • Globus Toolkit 4.0.1

  • Globus Toolkit 4.0.2

  • Globus Toolkit 4.0.3

  • Globus Toolkit 4.0.4

  • Globus Toolkit 4.0.5

  • Globus Toolkit 4.0.6

  • Globus Toolkit 4.0.7

  • Globus Toolkit 4.0.8

  • Globus Toolkit 4.2.0

  • Globus Toolkit 4.2.1

  • Globus Toolkit 5.0.0

  • Globus Toolkit 5.0.1

  • Globus Toolkit 5.0.2

  • Globus Toolkit 5.0.3

  • Globus Toolkit 5.0.4

  • Globus Toolkit 5.0.5

  • Globus Toolkit 5.2.0

  • Globus Toolkit 5.2.1


References

FEDORA - FEDORA-2012-8445

FEDORA - FEDORA-2012-8461

FEDORA - FEDORA-2012-8488

CONFIRM - http://jira.globus.org/browse/GT-195

DEBIAN - DSA-2523


Last Updated: 27 May 2016 10:57:32