News
Open Source Needs Better Security Focus, Study Says
The open source software community lags behind the commercial software sector
in secure code development, according to a
recent
study of some commonly used open source packages.
Fortify Software Inc., of San Mateo, Calif., examined 16 applications and found
that vulnerabilities often were not fixed in new releases and, in some cases,
the number of vulnerabilities actually increased.
In examining the organizations maintaining the applications, the study found
a lack of dedicated security experts and secure coding standards, and a focus
on functionality rather than security and risk mitigation.
The issues are significant because enterprises are increasingly adopting open
source software. Users could be exposed to unnecessary security risks if they
are not closely examining the code in their applications, the study warned.
Fortify conducted the study because of the number of its banking-industry clients
who were reviewing and, in many cases, rebuilding open source applications.
"Government and commercial organizations that leverage open source should follow
the example of the financial services industry and use open source applications
with great caution," the study stated.
It also recommended that open source communities adopt the robust security
practices many of their commercial counterparts now use.
Although far from perfect, "in general, the commercial side is slightly
ahead" in secure software development, said Rob Rachwald, Fortify's
director of product marketing.
Open source software has a more transparent development process in which source
code is available to users, who can examine, use and modify it as they wish.
The process seeks to produce more functional, adaptive applications without
hidden features and allows a broad community to identify flaws. But many vulnerabilities
go unrecognized or, if recognized, go unfixed over several generations of software.
"Only one of the packages surveyed showed a net decline in vulnerabilities
over three generations of releases," the study stated.
Fortify used its static code analysis tool to examine two to four versions
of each Java-based open source application. Analysts manually verified any major
security issues the tool discovered.
The applications studied were:
- Cayenne, an object-relational mapping tool.
- Hibernate, an object-relational mapping tool.
- Derby, an application server.
- Geronimo, an application server.
- Hipergate, a Web-based customer relationship management application.
- JBoss, an application server.
- Jonas, an application server.
- Jbopen source, an application server.
- Ofbiz, a Web-based CRM application.
- OpenJMS, a Java Message Service solution.
- OpenCMS, a content management tool.
- Resin, an application server.
- Shale, JSF Web framework.
- Struts, a Web application.
- Tomcat, a servlet engine.
- Webharvest, a Web crawler.
The study found a total of 44,233 vulnerabilities in the 4.25 million lines
of code examined. Hipergate 3.0.26 topped the list with 14,425 vulnerabilities
in about 81,000 lines of code. The two most common vulnerabilities overall were
cross-site scripting, with 22,828, and SQL injection, with 15,612.
Fortify made details of the vulnerabilities available to the applications'
development teams but did not include them in the public report.
The company recommended that security be integrated into the development process,
with someone assigned that role. So far, that approach is the exception rather
than the rule.
"We see promising signs," the study stated. "In July 2008, Mozilla announced
a security initiative to improve the browser's security, hiring independent
security consultant Rich Mogul as an adviser."
The report recommended that other teams follow Mozilla's lead.
About the Author
William Jackson is the senior writer for Government Computer News (GCN.com).