From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.6) Gecko/20050328 Firefox/1.0.2 Fedora/1.0.2-3 Description of problem: unixODBC, at least with the postgresql driver (I haven't tried other drivers), creates insecure log files in /tmp when the debug=1 option is set in odbc.ini. Problems: 1. They contain passwords 2. They are world-readable(!) 3. Their filenames are predictable (mkstemp not used, apparently). Version-Release number of selected component (if applicable): unixODBC-2.2.9-1 How reproducible: Always Steps to Reproduce: 1. Install a program that uses ODBC. 2. Put debug=1 in /etc/odbc.ini 3. Restart the program that uses ODBC (in my case, "service ldap restart"). Actual Results: A log file appears in /tmp, like this: -rw-r--r-- 1 ldap ldap 197307 Apr 7 17:46 mylog_ldap14229.log It contains the database password in the first few lines. 14229 is the pid of one of the ldap server processes (slapd), and this is not just a coincidence - log filenames are always generated from the pid. Expected Results: Either it should refuse to create a log file unless an explicit filename is given, or else I think it should use mkstemp (but still keep the pid in the filename for identification purposes) and set the permissions to -rw-------. Additional info: Not sure if this bug is in unixODBC or postgresql. postgresql-7.4.7-3.FC3.1
*** This bug has been marked as a duplicate of 154126 ***