#########################################################

elmo insecure temporary files creation

Vendor: http://elmo.sourceforge.net/
Advisory: http://www.zataz.net/adviso/elmo-06272005.txt
Vendor informed: yes
Exploit available: yes
Impact: low
Exploitation: low

#########################################################

The vulnerability is caused due to temporary file being created insecurely.
This can be exploited via symlink attacks in combination  to create and overwrite arbitrary
files with the privileges of the user running the affected script.

##########
Versions:
##########

elmo <= 1.3.2-r1

##########
Solution:
##########

To prevent symlink attack use kernel patch such as grsecurity

#########
Timeline:
#########

Discovered : 2005-06-27
Vendor notified : 2005-07-12
Vendor response :
Vendor fix :
Vendor Sec report (vendor-sec@lst.de) :
Disclosure :

#####################
Technical details :
#####################

Vulnerable code :

src/stats.c

203         fp = fopen ("/tmp/elmostats", "w");
204         if (fp == NULL){
205                 error_ (errno, _("couldn't open %s"), "/tmp/elmostats");
206                 destroy_stats (& stats);
207                 return;
208         }
209
210         fprintf (fp, "box path: %s\n", wrapbox_marray->path);
211         fprintf (fp, "count: %d\n\n", wrapbox_marray->count);

#########
Related :
#########

Bug report : http://bugs.gentoo.org/show_bug.cgi?id=97595
CVE :

#####################
Credits :
#####################

Eric Romang (eromang@zataz.net - ZATAZ Audit)
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, Koon, etc.)