173998 - flawfinder warnings in smime

Status: VERIFIED INVALID

(MailNews Core :: Security: S/MIME, defect, P3)

Description

[Stephen P. Morse]

Heikki ran flawfinder (http://www.dwheeler.com/flawfinder) on Mozilla 1.0.1 
branch.

flawfinder found 1 warnings in smime code (3742). Go through
that list and for each warning:

* If it is false positive, comment here why it is not an issue
* If it is a real issue, make patch for it here and let's get them checked in

In addition to checking the branch, also check the trunk.

3742) mailnews/extensions/smime/src/nsMsgComposeSecure.cpp:162 [3] (random) 
srand: This function is not sufficiently random for security-related functions 
such as key and nonce creation. use a more secure technique for acquiring random 
values.

Comment 1

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Reassigning to PSM, S/MIME.

Comment 2

[Kai Engert [:KaiE:]]

I suggest to resolve this bug as invalid.

The only suggestion being made here is about the pseudo randomness of the numbers.

However, in the place where the random function is used, we do not require real
randomness. All we require is a pseudo random mime part separator string, that
is unlikely to collide with other parts within the same MIME message. This
number is not used for anything hidden, it is readable in the clear anyway.

CC'ing Jean-Francois, in case he has to make similar decisions in other parts of
the mailnews MIME code.

Comment 3

[Charles Rosendahl]

I agree with Kai - there are no security issues here.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Ok, based on your comments marking as INVALID. Thanks.

Comment 5

[Charles Rosendahl]

verf'd