CVE-2012-3292: High severity globus toolkit vulnerability
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnamr function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3292?
CVE-2012-3292 has been classified as a high severity vulnerability due to the possibility of privilege escalation.
How do I fix CVE-2012-3292?
To mitigate CVE-2012-3292, upgrade the Globus Toolkit to version 5.2.2 or later.
What versions are affected by CVE-2012-3292?
CVE-2012-3292 affects Globus Toolkit versions 5.2.1 and earlier, as well as versions 2.x through 4.x.
Can CVE-2012-3292 be exploited remotely?
Yes, CVE-2012-3292 can be exploited by remote attackers to gain elevated privileges.
What function is improperly checked in CVE-2012-3292?
CVE-2012-3292 involves a lack of proper return value checking from the getpwnam_r function.