Security related - TMPDIR is not honored consistently

[proski]

Configuration Information [Automatically generated, do not change]:
Machine: i686
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i686' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DSHELL -DHAVE_CONFIG_H  -D_FILE_OFFSET_BITS=64  -I.  -I. 
-I./include -I./lib -I/usr/local/include -g -O2
uname output: Linux fonzie 2.4.0-ac4 #1 Tue Jan 9 11:11:16 EST 2001 i686 unknown
Machine Type: i686-pc-linux-gnu

Bash Version: 2.04
Patch Level: 0
Release Status: release

Description:
        Bash-2.04 hardcodes "/tmp" in several places. This makes it impossible
        to switch to per-user temp directories completely.
        The issue is discussed here: http://lwn.net/2000/1221/security.php3

Repeat-By:
[proski@fonzie bash-2.04]$ echo $BASH_VERSION
2.04.0(1)-release
        [proski@fonzie bash-2.04]$ ls -ld /var/tmp /tmp
        d---------    6 root     root         4096 Dec 21 18:40 /tmp
        drwxrwxrwt    2 root     root         4096 Dec 21 11:15 /var/tmp
        [proski@fonzie bash-2.04]$ TMPDIR=/var/tmp
        [proski@fonzie bash-2.04]$ cat <<EOF
        > EOF
        bash: cannot create temp file for here document: Permission denied

Fix:
        Write a routine that returns the temporary directory.
        Use TMPDIR and fall back to /tmp if it's not defined.
        Eliminate the word "/tmp" elsewhere in the sources.