PT-2006-4464 · Vmware · Vmware+3

Published 2006-07-19 · Updated 2018-10-30 · CVE-2006-3589

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions VMware for Linux, ESX Server 2.x, and Infrastructure 3

Description The issue is related to the vmware-config.pl script, which fails to check the return code from a Perl chmod function call. This might cause an SSL key file to be created with an unsafe umask, allowing local users to read or modify the SSL key.

Recommendations For VMware for Linux, ESX Server 2.x, and Infrastructure 3, ensure that the vmware-config.pl script properly sets the permissions for the SSL key file to prevent unauthorized access. As a temporary workaround, consider manually setting the correct permissions for the SSL key file until a proper fix is applied.

Fix

Related Identifiers

CVE-2006-3589

Affected Products

Esx Server

Infrastructure

Vmware

Vmware Workstation

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2006-3589 · Security Note
• http://secunia.com/advisories/21120 · Vendor Advisory
• http://securitytracker.com/id?1016536 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3589 · Note
• http://vmware.com/support/esx21/doc/esx-213-200612-patch.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27881 · Note
• http://vmware.com/support/esx25/doc/esx-253-200612-patch.html · Note
• http://vupen.com/english/advisories/2006/2880 · Note
• http://securityfocus.com/archive/1/440583/100/0/threaded · Note
• http://securityfocus.com/archive/1/441082/100/0/threaded · Note
• http://secunia.com/advisories/23680 · Note
• http://vmware.com/support/esx2/doc/esx-202-200612-patch.html · Note
• http://osvdb.org/27418 · Note
• http://vmware.com/support/esx25/doc/esx-254-200612-patch.html · Note
• http://securityfocus.com/bid/19062 · Note