Open source, open to attack
The open-source software community lags behind the commercial
software sector in secure code development, according to a recentstudy of some commonly used open-source packages.
Fortify Software Inc., of San Mateo, Calif., examined 16
applications and found that vulnerabilities often were not fixed in
new releases, and in some cases, the number of vulnerabilities
actually increased.
In examining the organizations maintaining the applications, the
study found a lack of dedicated security experts and secure coding
standards and a focus on functionality rather than security and
risk mitigation.
The issues are significant because enterprises are increasingly
adopting open-source software. Users could be exposed to
unnecessary security risks if they are not closely examining the
code in their applications, the study warns. Fortify conducted the
study because of the number of its banking-industry clients who
were reviewing and in many cases rebuilding open-source
applications.
'Government and commercial organizations that leverage
open source should follow the example of the financial services
industry and use open-source applications with great
caution,' the study states.
It also recommends that open-source communities adopt the robust
security practices many of their commercial counterparts now
use.
Although far from perfect, 'in general, the commercial
side is slightly ahead' in secure software development, said
Rob Rachwald, Fortify's director of product marketing.
Open-source software has a more transparent development process
in which source code is available to users, who can examine, use
and modify it as they wish. The process seeks to produce more
functional, adaptive applications without hidden features and
allows a broad community to identify flaws. But many
vulnerabilities go unrecognized or, if recognized, go unfixed over
several generations of software.
'Only one of the packages surveyed showed a net decline in
vulnerabilities over three generations of releases,' the
study states.
Fortify used its static code analysis tool to examine two to
four versions of each Java-based open-source application. Analysts
manually verified any major security issues the tool
discovered.
The applications studied were:
- Cayenne, an object-relational mapping tool.
- Hibernate, an object-relational mapping tool.
- Derby, an application server.
- Geronimo, an application server.
- Hipergate, a Web-based customer relationship management
application.
- JBoss, an application server.
- Jonas, an application server.
- Jbopen source, an application server.
- Ofbiz, a Web-based CRM application.
- OpenJMS, a Java Message Service solution.
- OpenCMS, a content management tool.
- Resin, an application server.
- Shale, JSF Web framework.
- Struts, a Web application.
- Tomcat, a servlet engine.
- Webharvest, a Web crawler.
The study found a total of 44,233 vulnerabilities in the 4.25
million lines of code examined. Hipergate 3.0.26 topped the list
with 14,425 vulnerabilities in about 81,000 lines of code. The two
most common vulnerabilities overall were cross-site scripting, with
22,828, and SQL injection, with 15,612.
Fortify made details of the vulnerabilities available to the
applications' development teams but did not include them in
the public report.
The company recommended that security be integrated into the
development process, with someone assigned that role. So far, that
approach is the exception rather than the rule.
'We see promising signs,' the study states.
'In July 2008, Mozilla announced a security initiative to
improve the browser's security, hiring independent security
consultant Rich Mogul as an adviser.'
The report recommends that other teams follow Mozilla's
lead.