| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <a6d87f571001060707q33ffe57embe3ff8b3811b77d7@mail.gmail.com> Date: Wed, 6 Jan 2010 11:07:07 -0400 From: dd@...uri.net To: full-disclosure <full-disclosure@...ts.grok.org.uk> Subject: VMware server (2.0.2) insecure file creation Have anyone noticed that the files created by the VMware server installer all have the 777 permissions to it? I just installed it on two systems with the same problem.... These are the alerts coming from ossec (the whole /usr/lib/vmware is 777): File '/usr/lib/vmware/hostd/docroot/print.css' is owned by root and has written permissions to anyone. File '/usr/lib/vmware/hostd/docroot/client/clients.xml' is owned by root and has written permissions to anyone. File '/usr/lib/vmware/hostd/docroot/sdk/vim.wsdl' is owned by root and has written permissions to anyone. .. more hundred files... File '/usr/lib/vmware/hostd/docroot/sdk/vimServiceVersions.xml' is owned by root and has written permissions to anyone. File '/usr/lib/vmware/hostd/docroot/error-32x32.png' is owned by root and has written permissions to anyone. Link to it: http://blog.sucuri.net/2010/01/vmware-insecure-file-creation.html --dd _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists