CVE-2012-3292

Publication date 7 June 2012

Last updated 24 July 2024

Ubuntu priority

Description

The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
globus-gridftp-server	12.04 LTS precise	Fixed 6.5-1ubuntu0.1
	11.10 oneiric	Fixed 3.33-2ubuntu0.1
	11.04 natty	Fixed 3.23-1ubuntu0.1
	10.04 LTS lucid	Fixed 3.17-2ubuntu0.1
	8.04 LTS hardy	Not in release
globus-gridftp-server-control	12.04 LTS precise	Fixed 2.3-1ubuntu0.1
	11.10 oneiric	Fixed 0.46-1ubuntu0.1
	11.04 natty	Fixed 0.43-1ubuntu0.1
	10.04 LTS lucid	Fixed 0.36-1ubuntu0.1
	8.04 LTS hardy	Not in release

Notes

sbeattie

it affects releases older than 5.2 if threading was enabled note 6.5-1 was when 5.2.0 toolkit was introduced

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
globus-gridftp-server	Vendor: http://www.debian.org/security/2012/dsa-2523
globus-gridftp-server-control	Vendor: http://www.debian.org/security/2012/dsa-2523