CVE-2012-3292

Published: Jun 7, 2012Modified: Apr 29, 2026

7.6

Vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability: 4.9 / Impact: 10.0

Source: NVD

Description

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.

Affected (24)

Products: Globus: Globus Toolkit

Globus

1 product

Globus Toolkit

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Globus Globus Toolkit	Up to 5.2.1
Globus Globus Toolkit	Version 2.0
Globus Globus Toolkit	Version 2.2
Globus Globus Toolkit	Version 2.4.3
Globus Globus Toolkit	Version 3.0.2
Globus Globus Toolkit	Version 3.2.1
Globus Globus Toolkit	Version 4.0.0
Globus Globus Toolkit	Version 4.0.1
Globus Globus Toolkit	Version 4.0.2
Globus Globus Toolkit	Version 4.0.3
Globus Globus Toolkit	Version 4.0.4
Globus Globus Toolkit	Version 4.0.5
Globus Globus Toolkit	Version 4.0.6
Globus Globus Toolkit	Version 4.0.7
Globus Globus Toolkit	Version 4.0.8
Globus Globus Toolkit	Version 4.2.0
Globus Globus Toolkit	Version 4.2.1
Globus Globus Toolkit	Version 5.0.0
Globus Globus Toolkit	Version 5.0.1
Globus Globus Toolkit	Version 5.0.2
Globus Globus Toolkit	Version 5.0.3
Globus Globus Toolkit	Version 5.0.4
Globus Globus Toolkit	Version 5.0.5
Globus Globus Toolkit	Version 5.2.0