CVE-2006-3589

Severity: low (CVSS 3.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-19 · updated 2026-06-16

Description

vmware-config.pl in VMware for Linux, ESX Server 2.x, and Infrastructure 3 does not check the return code from a Perl chmod function call, which might cause an SSL key file to be created with an unsafe umask that allows local users to read or modify the SSL key.

Affected products

VMware ESX: 2.0, 2.0.1, 2.1, 2.1.1, 2.1.2, 2.5 (+1)
VMware Infrastructure: 3
VMware Player: all versions
VMware Server: 1.0.1_build_29996
VMware Workstation: 5.5.3

References

http://kb.vmware.com/kb/2467205
http://secunia.com/advisories/21120
http://secunia.com/advisories/23680
http://securitytracker.com/id?1016536
http://www.osvdb.org/27418
http://www.securityfocus.com/archive/1/440583/100/0/threaded
http://www.securityfocus.com/archive/1/441082/100/0/threaded
http://www.securityfocus.com/archive/1/456546/100/200/threaded
http://www.securityfocus.com/bid/19060
http://www.securityfocus.com/bid/19062
http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html
http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html

Get alerted when CVE-2006-3589 or the next vulnerability affects your stack