unsafe use of /tmp files

[Seth Arnold]

There is an unsafe use of /tmp files in cryptcab:

if ((od = creat ("/tmp/.blowfish.key",0600)) == -1){

Note that creat(2) cannot protect against symlink attacks because it does not include the open(2) O_EXCL flag.

It also seems odd to hard code a filename here rather than use mkstemp(3) to generate a random filename and properly create the file (using O_EXCL to open(2)).

[Seth Arnold (seth-arnold)]

https://sourceforge.net/tracker/?func=detail&aid=3603897&group_id=95403&atid=611248