VMware has acknowledged a weakness and a vulnerability in VMware ESX Server, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to cause a DoS (Denial of Service).

1) An error in libpng can be exploited by malicious people to cause a DoS.

For more information:
SA27093

2) The VMware Consolidated Backup(VCB) command-line utilities use the password as command line argument when invoking other programs. This can be exploited to disclose the password via e.g. the "ps" command.

Successful exploitation requires access to the service console.

This vulnerability does not affect VMware ESXi 3.5.

Solution
Apply patches. See vendor advisory for details.

Provided and/or discovered by
2) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
VMSA-2008-0014:
http://www.vmware.com/security/advisories/VMSA-2008-0014.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers