VMware vmware-config.pl Insecure SSL Key File Permissions

OS: VMware ESX Server 2.x
VMware ESX Server 3.x

Software: VMware GSX Server 3.x
VMware Player 1.x
VMware Server 1.x
VMware Workstation 5.x

A security issue has been reported in VMware, which potentially can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is caused due to missing return code checks of the “chmod()” call in vmware-config.pl when setting permissions for SSL key files. This may potentially result in insecure read permissions being set on the key file.

Solution: The vendor recommends to changing the file permissions (see vendor advisory).

Leave a Reply