7.6

CVE-2012-3292

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Globus ≫ Globus Toolkit Version <= 5.2.1
Globus ≫ Globus Toolkit Version 2.0
Globus ≫ Globus Toolkit Version 2.2
Globus ≫ Globus Toolkit Version 2.4.3
Globus ≫ Globus Toolkit Version 3.0.2
Globus ≫ Globus Toolkit Version 3.2.1
Globus ≫ Globus Toolkit Version 4.0.0
Globus ≫ Globus Toolkit Version 4.0.1
Globus ≫ Globus Toolkit Version 4.0.2
Globus ≫ Globus Toolkit Version 4.0.3
Globus ≫ Globus Toolkit Version 4.0.4
Globus ≫ Globus Toolkit Version 4.0.5
Globus ≫ Globus Toolkit Version 4.0.6
Globus ≫ Globus Toolkit Version 4.0.7
Globus ≫ Globus Toolkit Version 4.0.8
Globus ≫ Globus Toolkit Version 4.2.0
Globus ≫ Globus Toolkit Version 4.2.1
Globus ≫ Globus Toolkit Version 5.0.0
Globus ≫ Globus Toolkit Version 5.0.1
Globus ≫ Globus Toolkit Version 5.0.2
Globus ≫ Globus Toolkit Version 5.0.3
Globus ≫ Globus Toolkit Version 5.0.4
Globus ≫ Globus Toolkit Version 5.0.5
Globus ≫ Globus Toolkit Version 5.2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.1% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.6 4.9 10
AV:N/AC:H/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://jira.globus.org/browse/GT-195
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html
http://www.debian.org/security/2012/dsa-2523