CVE-2012-3292
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does...
CVE-2012-3292 is a high vulnerability (CVSS 7.6) in Globus Toolkit, published June 7, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.07%, the 87th percentile. Fixed in globus-gridftp-server 6.5-1.
- Severity
- 7.6 HighCVSS 2.0, NVD
- Exploit chance
- 3.07%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.5-1globus-gridftp-server +3 more
Description
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
globus-gridftp-serverDebian:12 | before 6.5-1 | 6.5-1 |
globus-gridftp-serverDebian:13 | before 6.5-1 | 6.5-1 |
globus-gridftp-serverDebian:14 | before 6.5-1 | 6.5-1 |
globus-gridftp-serverDebian:6.0 | before 3.23-1+squeeze1, plus listed versions 3.23-1 | 3.23-1+squeeze1 |
What each source reports
NVD Score used
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
CVE-2012-3292- CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
CVE-2012-3292- Updated
- 2026-11-02
EUVDEUVD-2012-3270No score
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
EUVD-2012-3270- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qc5-pr45-rv6rNo score
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does...
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
GHSA-5qc5-pr45-rv6r- Updated
- 2026-11-02
OSVNo score
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
CVE-2012-3292- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3292No score
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
- Record
DEBIAN-CVE-2012-3292- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html
debian.org/security/2012/dsa-2523
jira.globus.org/browse/GT-195
nvd.nist.gov/vuln/detail/CVE-2012-3292
github.com/advisories/GHSA-5qc5-pr45-rv6r
security-tracker.debian.org/tracker/CVE-2012-3292