Open source, open to attack

The open-source software community lags behind the commercial software sector in secure code development, according to a recent study of some commonly used open-source packages.

Fortify Software Inc., of San Mateo, Calif., examined 16 applications and found that vulnerabilities often were not fixed in new releases, and in some cases, the number of vulnerabilities actually increased.

In examining the organizations maintaining the applications, the study found a lack of dedicated security experts and secure coding standards and a focus on functionality rather than security and risk mitigation.

The issues are significant because enterprises are increasingly adopting open-source software. Users could be exposed to unnecessary security risks if they are not closely examining the code in their applications, the study warns. Fortify conducted the study because of the number of its banking-industry clients who were reviewing and in many cases rebuilding open-source applications.

“Government and commercial organizations that leverage open source should follow the example of the financial services industry and use open-source applications with great caution,” the study states.

It also recommends that open-source communities adopt the robust security practices many of their commercial counterparts now use.

Although far from perfect, “in general, the commercial side is slightly ahead” in secure software development, said Rob Rachwald, Fortify’s director of product marketing.

Open-source software has a more transparent development process in which source code is available to users, who can examine, use and modify it as they wish. The process seeks to produce more functional, adaptive applications without hidden features and allows a broad community to identify flaws. But many vulnerabilities go unrecognized or, if recognized, go unfixed over several generations of software.

“Only one of the packages surveyed showed a net decline in vulnerabilities over three generations of releases,” the study states.

Fortify used its static code analysis tool to examine two to four versions of each Java-based open-source application. Analysts manually verified any major security issues the tool discovered.

The applications studied were:

• Cayenne, an object-relational mapping tool.
• Hibernate, an object-relational mapping tool.
• Derby, an application server.
• Geronimo, an application server.
• Hipergate, a Web-based customer relationship management application.
• JBoss, an application server.
• Jonas, an application server.
• Jbopen source, an application server.
• Ofbiz, a Web-based CRM application.
• OpenJMS, a Java Message Service solution.
• OpenCMS, a content management tool.
• Resin, an application server.
• Shale, JSF Web framework.
• Struts, a Web application.
• Tomcat, a servlet engine.
• Webharvest, a Web crawler.

Fortify made details of the vulnerabilities available to the applications’ development teams but did not include them in the public report.

The company recommended that security be integrated into the development process, with someone assigned that role. So far, that approach is the exception rather than the rule.

“We see promising signs,” the study states. “In July 2008, Mozilla announced a security initiative to improve the browser’s security, hiring independent security consultant Rich Mogul as an adviser.”

The report recommends that other teams follow Mozilla’s lead.