Description
vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.
References
- http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
- 19060 vdb-entry
- 23680 third-party-advisory
- 21120 third-party-advisory
- 1016536 vdb-entry
- http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
- http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
- 20060718 VMSA-2006-0003 VMware possible incorrect permissions on SSL key files mailing-list
- ADV-2006-2880 vdb-entry
- 19062 vdb-entry
- 20070110 VMware ESX server security updates mailing-list
- 27418 vdb-entry
- vmware-vmwareconfig-file-permissions(27881) vdb-entry
- http://kb.vmware.com/kb/2467205
- 20060725 Advisory: VMware Possible Incorrect Permissions On SSL Key Files mailing-list
- http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html