Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

VMware server (2.0.2) insecure file creation
From: dd () sucuri net
Date: Wed, 6 Jan 2010 11:07:07 -0400

Have anyone noticed that the files created by the VMware server
installer all have the 777 permissions
to it?

I just installed it on two systems with the same problem....

These are the alerts coming from ossec (the whole /usr/lib/vmware is 777):

File '/usr/lib/vmware/hostd/docroot/print.css' is owned by root and
has written permissions to anyone.
File '/usr/lib/vmware/hostd/docroot/client/clients.xml' is owned by
root and has written permissions to anyone.
File '/usr/lib/vmware/hostd/docroot/sdk/vim.wsdl' is owned by root and
has written permissions to anyone.
.. more hundred files...
File '/usr/lib/vmware/hostd/docroot/sdk/vimServiceVersions.xml' is
owned by root and has written permissions to anyone.
File '/usr/lib/vmware/hostd/docroot/error-32x32.png' is owned by root
and has written permissions to anyone.

Link to it:
http://blog.sucuri.net/2010/01/vmware-insecure-file-creation.html


--dd

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]