Hello, Take a look at : src/stats.c 203 fp = fopen ("/tmp/elmostats", "w"); 204 if (fp == NULL){ 205 error_ (errno, _("couldn't open %s"), "/tmp/elmostats"); 206 destroy_stats (& stats); 207 return; 208 } 209 210 fprintf (fp, "box path: %s\n", wrapbox_marray->path); 211 fprintf (fp, "count: %d\n\n", wrapbox_marray->count); Regards.
confirmed, it looks like you can hook dump_stats to events and that file will be created insecurely, looks like upstream is dead (according to elmo.sf.net), so we will have to patch or mask. I would suggest mocing that file to ~/.elmo_stats or something.
I guess we should provide a patch, unless net-mail wants to drop the package. Pulling in citizen428 for advice.
Hello, UPsteam notified but the project seems to be dead. Regards.
Actually I've given up on maintaining Elmo because I don't use it anymore, so if someone wants to mask it for security reasons, I'm fine with that.
CC'ing Ticho.
Ticho any news on this one? (No other volunteered)
I just have some translations to finish due today and I'll have a look at it. What's the problem here actually? The fact that a predictably named file is created in /tmp (i.e. no mkstemp() ) ?
Yes.
elmo-1.3.2-r2 is in portage. Using mkstemp() with template "/tmp/elmostatsXXXXXX".
Andrej: but wont that make it difficult to find the stats? not a security problem though, if it's okay with you, it's fine from a security standpoint.
Yes, I've thought of that, but if elmo wants to have stats dumped in /tmp, so be it - this only makes it more secure. :)
Changing status to SEMIPUBLIC as this is in Portage now. Romang is it ok with you to open this one now? Arch Security Liaisons please test and mark stable.
Hello, Yes it's OK. Regards
Opening.
Stable on alpha.
ticho: could you mark x86 stable ? The fix is rather harmless and alpha already tested it.
Done. Sorry for the delay.
Eh, removing relevant arch.
This one is ready for GLSA decision. I tend to vote NO.
I vote also NO. Using stats doesn't seem the usual usage of that nearly-abandoned package. Closing, reopen if you think this one needs a GLSA.
(In reply to comment #20) > I vote also NO. Using stats doesn't seem the usual usage of that > nearly-abandoned package. It *is* an abandoned package. To quote elmo's website: "Project is Closed /2005-01-06/ After over half a year not doing anything with Elmo I decided to admit that nothing is going to change. I want to thank all the people around the world who have helped and supported me."
