CVE-2006-3589: Low severity VMware Server vulnerability
vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3589?
CVE-2006-3589 is considered to have moderate severity due to the potential exposure of SSL key files.
How do I fix CVE-2006-3589?
To fix CVE-2006-3589, ensure proper permissions are set on the SSL key files and update the affected VMware products to the latest versions.
Which VMware products are affected by CVE-2006-3589?
CVE-2006-3589 affects VMware Server 1.0.1, VMware Workstation 5.5.3, VMware ESX versions 2.0 to 2.5.2, and VMware Virtual Infrastructure Client 3.
What kind of attack can exploit CVE-2006-3589?
An attacker with local access can exploit CVE-2006-3589 to read or modify unsafe SSL key files due to incorrect permissions.
Is there a patch available for CVE-2006-3589?
Yes, VMware has released updates for the affected products to mitigate the vulnerability identified as CVE-2006-3589.