Vulnerability Description
vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Infrastructure | 3 |
| Vmware | Player | All versions |
| Vmware | Server | 1.0.1_build_29996 |
| Vmware | Workstation | 5.5.3 |
| Vmware | Esx | 2.0 |
References
- http://kb.vmware.com/kb/2467205
- http://secunia.com/advisories/21120Vendor Advisory
- http://secunia.com/advisories/23680
- http://securitytracker.com/id?1016536
- http://www.osvdb.org/27418
- http://www.securityfocus.com/archive/1/440583/100/0/threaded
- http://www.securityfocus.com/archive/1/441082/100/0/threaded
- http://www.securityfocus.com/archive/1/456546/100/200/threaded
- http://www.securityfocus.com/bid/19060
- http://www.securityfocus.com/bid/19062
- http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
- http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
- http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
- http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
- http://www.vupen.com/english/advisories/2006/2880
FAQ
What is CVE-2006-3589?
CVE-2006-3589 is a vulnerability with a CVSS score of 3.6 (LOW). vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsaf...
How severe is CVE-2006-3589?
CVE-2006-3589 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-3589?
Check the references section above for vendor advisories and patch information. Affected products include: Vmware Infrastructure, Vmware Player, Vmware Server, Vmware Workstation, Vmware Esx.