CVE-2006-3589

vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.

CVSS v2.0 3.6 LOW

3.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 3.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://kb.vmware.com/kb/2467205
http://www.securityfocus.com/bid/19060
http://www.securityfocus.com/bid/19062
http://secunia.com/advisories/21120	Vendor Advisory
http://securitytracker.com/id?1016536
http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
http://secunia.com/advisories/23680
http://www.osvdb.org/27418
http://www.vupen.com/english/advisories/2006/2880
https://exchange.xforce.ibmcloud.com/vulnerabilities/27881
http://www.securityfocus.com/archive/1/456546/100/200/threaded
http://www.securityfocus.com/archive/1/441082/100/0/threaded
http://www.securityfocus.com/archive/1/440583/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:vmware:esx:2.1.1:::::::*
	cpe:2.3:o:vmware:esx:2.1.2:::::::*
	cpe:2.3:o:vmware:esx:2.1:::::::*
	cpe:2.3:a:vmware:server:1.0.1_build_29996:::::::*
	cpe:2.3:a:vmware:workstation:5.5.3:::::::*
	cpe:2.3:o:vmware:esx:2.0.1:::::::*
	cpe:2.3:a:vmware:infrastructure:3:::::::*
	cpe:2.3:a:vmware:player::::::::
	cpe:2.3:o:vmware:esx:2.0:::::::*
	cpe:2.3:o:vmware:esx:2.5:::::::*
	cpe:2.3:o:vmware:esx:2.5.2:::::::*

Information

Published : 2006-07-21 07:03

Updated : 2018-10-30 09:26

NVD link : CVE-2006-3589

Mitre link : CVE-2006-3589

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

vmware

workstation
player
infrastructure
esx
server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://kb.vmware.com/kb/2467205", "name": "http://kb.vmware.com/kb/2467205", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/19060", "name": "19060", "tags": [], "refsource": "BID"}, {"url": "http://www.securityfocus.com/bid/19062", "name": "19062", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/21120", "name": "21120", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1016536", "name": "1016536", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html", "name": "http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html", "name": "http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html", "name": "http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html", "name": "http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html", "tags": [], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/23680", "name": "23680", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/27418", "name": "27418", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2006/2880", "name": "ADV-2006-2880", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27881", "name": "vmware-vmwareconfig-file-permissions(27881)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/456546/100/200/threaded", "name": "20070110 VMware ESX server security updates", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/441082/100/0/threaded", "name": "20060725 Advisory: VMware Possible Incorrect Permissions On SSL Key Files", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/440583/100/0/threaded", "name": "20060718 VMSA-2006-0003 VMware possible incorrect permissions on SSL key files", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3589", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-07-21T14:03Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:vmware:esx:2.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:vmware:server:1.0.1_build_29996:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:vmware:workstation:5.5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:vmware:infrastructure:3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:vmware:esx:2.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:26Z"}