[jira] Closed: (HARMONY-4663) [classlib][luni]File.createTempFile() is insecure

["Tim Ellison (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/HARMONY-4663?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tim Ellison closed HARMONY-4663.
--------------------------------


No response, assuming it is ok.

> [classlib][luni]File.createTempFile() is insecure
> -------------------------------------------------
>
>                 Key: HARMONY-4663
>                 URL: https://issues.apache.org/jira/browse/HARMONY-4663
>             Project: Harmony
>          Issue Type: Bug
>          Components: Classlib
>            Reporter: Imran Ghory
>            Assignee: Tim Ellison
>
> createTempFile() generates  a random file name by calling   genTempFile(prefix, newSuffix, tmpDirFile), however that function generates it's randomness by calling new java.util.Random().nextInt(); which creates a Random() object seeded with the current time. This makes it predictable and thus insecure[1].
> [1] See section "7.10.1.2. Temporary Files" at  http://www.faqs.org/docs/Linux-HOWTO/Secure-Programs-HOWTO.html

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.