PT-2006-4464 · Vmware · Vmware+3

Publicado 2006-07-19 · Atualizado 2018-10-30 · CVE-2006-3589

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware for Linux, ESX Server 2.x, and Infrastructure 3

Description The issue is related to the vmware-config.pl script, which fails to check the return code from a Perl chmod function call. This might cause an SSL key file to be created with an unsafe umask, allowing local users to read or modify the SSL key.

Recommendations For VMware for Linux, ESX Server 2.x, and Infrastructure 3, ensure that the vmware-config.pl script properly sets the permissions for the SSL key file to prevent unauthorized access. As a temporary workaround, consider manually setting the correct permissions for the SSL key file until a proper fix is applied.

Correção

Identificadores relacionados

CVE-2006-3589

Produtos afetados

Esx Server

Infrastructure

Vmware

Vmware Workstation

Referências · 18

• http://securitytracker.com/id?1016536 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3589 · Nota
• http://vmware.com/support/esx21/doc/esx-213-200612-patch.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3589 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27881 · Nota
• http://secunia.com/advisories/21120 · Aviso do Fabricante
• http://vmware.com/support/esx25/doc/esx-253-200612-patch.html · Nota
• http://vupen.com/english/advisories/2006/2880 · Nota
• http://securityfocus.com/archive/1/440583/100/0/threaded · Nota
• http://securityfocus.com/archive/1/441082/100/0/threaded · Nota
• http://secunia.com/advisories/23680 · Nota
• http://vmware.com/support/esx2/doc/esx-202-200612-patch.html · Nota
• http://osvdb.org/27418 · Nota
• http://vmware.com/support/esx25/doc/esx-254-200612-patch.html · Nota
• http://securityfocus.com/bid/19062 · Nota