CVE-2012-3292 Privilege escalation in n/a

What is CVE-2012-3292?

CVE-2012-3292 is a high-severity vulnerability in n/a, published on 7 Jun 2012. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.

Weakness: CWE-264

Which versions are affected by CVE-2012-3292?

It affects 1 product.

Products include Globus Globus Toolkit.

How do I fix CVE-2012-3292?

Upgrade to a fixed version.

Is CVE-2012-3292 being exploited?

There is no known exploitation of CVE-2012-3292 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2007-2784 Denial of service in n/a High 7.8
• CVE-2011-0738 Security feature bypass in n/a Medium 4.3
• CVE-2006-4233 Path traversal in n/a Low 3.6
• CVE-2006-4232 Race condition in n/a Low 1.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2012-3292, DSA-2523-1, GHSA-5qc5-pr45-rv6r.