News

Open Source Needs Better Security Focus, Study Says

• By William Jackson
• 07/22/2008

Fortify Software Inc., of San Mateo, Calif., examined 16 applications and found that vulnerabilities often were not fixed in new releases and, in some cases, the number of vulnerabilities actually increased.

In examining the organizations maintaining the applications, the study found a lack of dedicated security experts and secure coding standards, and a focus on functionality rather than security and risk mitigation.

The issues are significant because enterprises are increasingly adopting open source software. Users could be exposed to unnecessary security risks if they are not closely examining the code in their applications, the study warned. Fortify conducted the study because of the number of its banking-industry clients who were reviewing and, in many cases, rebuilding open source applications.

"Government and commercial organizations that leverage open source should follow the example of the financial services industry and use open source applications with great caution," the study stated.

It also recommended that open source communities adopt the robust security practices many of their commercial counterparts now use.

Although far from perfect, "in general, the commercial side is slightly ahead" in secure software development, said Rob Rachwald, Fortify's director of product marketing.

Open source software has a more transparent development process in which source code is available to users, who can examine, use and modify it as they wish. The process seeks to produce more functional, adaptive applications without hidden features and allows a broad community to identify flaws. But many vulnerabilities go unrecognized or, if recognized, go unfixed over several generations of software.

"Only one of the packages surveyed showed a net decline in vulnerabilities over three generations of releases," the study stated.

Fortify used its static code analysis tool to examine two to four versions of each Java-based open source application. Analysts manually verified any major security issues the tool discovered.

The applications studied were:

• Cayenne, an object-relational mapping tool.
• Hibernate, an object-relational mapping tool.
• Derby, an application server.
• Geronimo, an application server.
• Hipergate, a Web-based customer relationship management application.
• JBoss, an application server.
• Jonas, an application server.
• Jbopen source, an application server.
• Ofbiz, a Web-based CRM application.
• OpenJMS, a Java Message Service solution.
• OpenCMS, a content management tool.
• Resin, an application server.
• Shale, JSF Web framework.
• Struts, a Web application.
• Tomcat, a servlet engine.
• Webharvest, a Web crawler.

The study found a total of 44,233 vulnerabilities in the 4.25 million lines of code examined. Hipergate 3.0.26 topped the list with 14,425 vulnerabilities in about 81,000 lines of code. The two most common vulnerabilities overall were cross-site scripting, with 22,828, and SQL injection, with 15,612.

Fortify made details of the vulnerabilities available to the applications' development teams but did not include them in the public report.

The company recommended that security be integrated into the development process, with someone assigned that role. So far, that approach is the exception rather than the rule.

"We see promising signs," the study stated. "In July 2008, Mozilla announced a security initiative to improve the browser's security, hiring independent security consultant Rich Mogul as an adviser."

The report recommended that other teams follow Mozilla's lead.