Secunia Advisory: SA21120   
Release Date: 2006-07-19

Critical: Less critical

Impact: Exposure of sensitive information
 
Where: Local system
 
Solution Status: Vendor Workaround

 
OS:

VMware ESX Server 2.x
VMware ESX Server 3.x

 
Software:

VMware GSX Server 3.x
VMware Player 1.x
VMware Server 1.x
VMware Workstation 5.x

 
Description:
A security issue has been reported in VMware, which potentially can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is caused due to missing return code checks of the "chmod()" call in vmware-config.pl when setting permissions for SSL key files. This may potentially result in insecure read permissions being set on the key file.

Solution:
The vendor recommends to changing the file permissions (see vendor advisory).

Provided and/or discovered by: Reported by the vendor.

Original Advisory: http://kb.vmware.com/kb/2467205
 

Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.