Nick Brees has reported a vulnerability in VMware, which potentially can be exploited by malicious, local users to gain knowledge of sensitive information.

The problem is caused due to missing return code checks of the "chmod()" call in vmware-config.pl when setting permissions for SSL key files. This may potentially result in insecure read permissions being set on the key file.

Solution
The vendor recommends to changing the file permissions (see vendor advisory).
Further details available to Secunia VIM customers

Provided and/or discovered by
Nick Brees, Security-Assessment.com.

Changelog
Further details available to Secunia VIM customers

Original Advisory
VMware:
http://kb.vmware.com/kb/2467205
http://www.vmware.com/support/esx25/doc/esx-254-200612-patch.html
http://www.vmware.com/support/esx25/doc/esx-253-200612-patch.html
http://www.vmware.com/support/esx21/doc/esx-213-200612-patch.html
http://www.vmware.com/support/esx2/doc/esx-202-200612-patch.html

Security-Assessment.com:
http://www.security-assessment.com/Advisories/VMware_Possible_Incorrect_Permissions_On_SSL_Key_Files.pdf

Deep Links
Links available to Secunia VIM customers