Vulnerabilities / Threats
12/3/2013
03:49 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Many Commercial Software Projects Contain Older, Vulnerable Open-Source Code

More than one-fifth contain older and less secure versions of open-source code, new study finds

A study of nearly 3,000 commercial software projects found that some 23 percent of them contain open-source components with security flaws.

White Source Software also found that some 98.7 percent of those vulnerable open-source libraries were not the most up-to-date versions. Rami Sass, CEO of White Source, says that's because there's typically a disconnect between the open-source community and the developers who adopt their code in their software projects.

"Developers don't have a good way to keep track and in touch with the work the open-source community members do and the patches and security issues they track," Sass says. "The chances [are better] that developers hear about [open-source] security vulnerabilities in their projects only if it comes out in the press. Otherwise, they're not going to go out and look."

White Source studied open-source library information from various commercial projects as well as an index of known vulnerabilities to gather the data.

Open-source software increasingly is being scrutinized for vulnerabilities, and security experts have been warning enterprises to ensure they are using the most updated versions of open-source libraries. An estimated 80 to 90 percent of custom software uses open-source libraries.

The FS-ISAC (Financial Services Information Sharing and Analysis Center) last month proposed a series of basic security controls for ensuring the security of third-party software used by financial services firms, including policy management for open-source software libraries and components. The goal is to help financial firms ensure their developers are adopting the most current and secure versions of open-source code.

White Source's Sass says open-source software is typically secure. "Open-source communities are very diligent and go through a lot of trouble fixing and identifying problems. The real issue is the disconnect between that community and its end users," he says. Many organizations who build their apps with open-source code don't keep track of updates or patches, for example, he says.

The most common open-source security flaws found in the study were CVE-2011-2730, a configuration flaw in the Spring Framework; CVE-2012-0213, a resource management error in Apache; CVE-2011-2894, a permissions, privileges, and access control flaw in Spring; CVE-2009-2625, a permissions, privileges, and access control flaw in Apache Xerces2; and CVE-2013-0248, a permissions, privileges, and access control flaw in Apache Commons FileUpload.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
davidneville
50%
50%
davidneville,
User Rank: Apprentice
1/31/2014 | 6:02:34 PM
re: Many Commercial Software Projects Contain Older, Vulnerable Open-Source Code
Dave Wichers talks about this in his three-part series on Contrast Security's blog: http://www1.contrastsecurity.c...

Key Takeaways:
1. If you are going to use open-source frameworks and libraries, avoid downloading libraries with known vulnerabilities, and update them when new updates/patches for the libraries you are already using are.
2. The earlier in your software development life cycle security flaws are found and eliminated, the cheaper it is for your organization.
3. Contrast doesn't care where the code comes from, or whether you even have access to the source code at all. Contrast will point out exactly where in the code each vulnerability is introduced, regardless of its source or pedigree.
EfratS034
50%
50%
EfratS034,
User Rank: Apprentice
12/4/2013 | 7:37:04 AM
re: Many Commercial Software Projects Contain Older, Vulnerable Open-Source Code
White Source full report at http://www.whitesourcesoftware...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web