vulnwire
3.6low

CVE-2006-3589

vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call,…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
3.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 37%
Public exploits
0
none known

vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.

Exploit prediction (EPSS)

0.43% probability of exploitation in the next 30 days, higher than 37% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.03.6AV:L/AC:L/Au:N/C:P/I:P/A:N

Classification

Technology feeds
VMware (RSS, critical only)

References

  • vmware.com /support/esx21/doc/esx-213-200612-patch.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/19060 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/23680 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/21120 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1016536 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • vmware.com /support/esx2/doc/esx-202-200612-patch.html · x_refsource_CONFIRM, x_transferred
  • vmware.com /support/esx25/doc/esx-254-200612-patch.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/440583/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vupen.com /english/advisories/2006/2880 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/19062 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/456546/100/200/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /27418 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/27881 · vdb-entry, x_refsource_XF, x_transferred
  • kb.vmware.com /kb/2467205 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /archive/1/441082/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • vmware.com /support/esx25/doc/esx-253-200612-patch.html · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.