The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 7.6 | HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
| Hyperlink | Source | Resource |
|---|---|---|
| http://jira.globus.org/browse/GT-195 | cve@mitre.org | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html | cve@mitre.org | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html | cve@mitre.org | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html | cve@mitre.org | N/A |
| http://www.debian.org/security/2012/dsa-2523 | cve@mitre.org | N/A |
| http://jira.globus.org/browse/GT-195 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081787.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081791.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-June/081797.html | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| http://www.debian.org/security/2012/dsa-2523 | af854a3a-2127-422b-91ae-364da2661108 | N/A |