NVD

Id
44910  
Name
CVE-2012-3292  
Description
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2012-06-07  
Modified Date
2012-09-07  
Seq
2012-3292  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
225037 44910 CVE-2012-3292 http://jira.globus.org/browse/GT-195  View
225038 44910 CVE-2012-3292 FEDORA-2012-8488  View
225039 44910 CVE-2012-3292 FEDORA-2012-8461  View
225040 44910 CVE-2012-3292 FEDORA-2012-8445  View
225041 44910 CVE-2012-3292 DSA-2523  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
26942 JVNDB-2012-002649 Globus Toolkit の GridFTP における権限を取得される脆弱性 Globus Toolkit (GT) の GridFTP は、特定の autoconf マクロが定義されている場合、getpwnam_r 関数から返された戻り値を適切にチェックしないため、権限を取得される脆弱性が存在します。 CVE-2012-3292 56530 CVE-2012-3292 44910 7.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002649.html 2012-05-17 2012-09-14 View