Overview
Certain versions of VMware ESX Server store passwords in a cleartext file that all users have read permissions to.
Description
Per the VMware ESX Server datasheet: ESX Server installs directly on the server hardware, or “bare metal,” and inserts a robust virtualization layer between the hardware and the operating system. ESX Server partitions a physical server into multiple secure and portable virtual machines that can run side by side on the same physical server.
|
Impact
Local users can read the passwords of any user who changed their password through the web interface. |
Solution
UpgradeVMware has issued upgrades that address this issue. Refer to VMware ESX Server 2.5.3 Upgrade Patch 2, VMware ESX Server 2.1.3 Upgrade Patch 1, or VMware ESX Server 2.0.2 Upgrade Patch 1 for more details. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Corsaire for reporting this vulnerability.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2005-3620 |
| Severity Metric: | 0.31 |
| Date Public: | 2006-07-31 |
| Date First Published: | 2006-08-24 |
| Date Last Updated: | 2006-08-29 13:49 UTC |
| Document Revision: | 38 |