What’s Vulnerable › Vulnerabilities

CVE-2012-3292

• Severity: high (CVSS 7.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-06-07 · updated 2026-06-16
• Weakness: CWE-264

Description

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.

Affected products

• Globus Toolkit: through 5.2.1; 2.0, 2.2, 2.4.3, 3.0.2, 3.2.1, 4.0.0 (+17)

References

• http://jira.globus.org/browse/GT-195
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html
• http://www.debian.org/security/2012/dsa-2523
• http://jira.globus.org/browse/GT-195
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html
• http://www.debian.org/security/2012/dsa-2523

Get alerted when CVE-2012-3292 or the next vulnerability affects your stack